TMG SSO issue with Windows 7 clients

Question

I have very strange problem with Forefront TMG 2010 Single Sign On feature.
SSO settings:
I'm publishing two websites (https://site1.domain.com and https://site2.domain.com) by using the same web listener with SSO enabled for *.domain.com
SSO is working as charm for Windows 8.1 clients
The issue when accessing sites from Windows 7 clients:
On the first access to any of the sites (i.e. site1), I'm getting TMG forms login form - as expected.
I login, then visit few pages of the same site (i.e. site1), and everything works as expected. I'm logged in, and I can surf.
The problem arises when I try to open the other site (i.e. site2). I'm getting TMG forms login form again! And even worse - as soon as new TMG login form opens -
I'm logged off from the first site also. So not just I must login separately for both sites - I can't be logged to both sites in the same time because as soon as I login to one site, the session with other site is terminated!
Interesting thing is that behavior is the same in any browser. I've tried with IE, Chrome and Mozilla - the problem is the same.
When external client tries to open the second site, TMG logs one interesting message:
Req ID: 0ae9f57b; Compression: client=Yes, server=No, compress rate=0% decompress rate=0% ;
FBA cookie: exists=yes, valid=no, updated=no, logged off=no, client type=private, user activity=yes
It looks that TMG finds that cookie is not valid and deletes it, terminating this way existing session with all sites.
My setup:
Array of two TMG's 2010 SP2 RU4, on Windows Server 2008 R2, all updates installed.
Published websites (site1.domain.com and site2.domain.com) are residing on two different servers (srv1 and srv2)
Websites are published over https by using SSL certificate gotten from local PKI. All clients and servers do have PKI CA in their "Trusted Root Certificates" storage. No client or server reports any certificate issue. Websites are "green"
in address bar.
I'm really confused with this behavior. Especially due to the fact that the same third-party browser (Chrome), can be used with SSO without any problem when installed on Windows 8.1, but not when installed on Windows 7!?!?
Any help would be appreciated...
Thanks!
Fat Dragon

Answer 1

Hahah! Shame on me! The problem is not related to Windows 8.1 / Windows 7. Client OS coincides with DNS server settings... To explain:
My two-server TMG array has two public IPs (each server having one) - 1.1.1.1 and 1.1.1.2.
In order to avoid setting the same IPs for all my websites, I've decided to create one common A record, and to define all websites as CNAME records pointing to this common A record. (This way I have just one place where I should change IP if it changes.)
My common A record is defined as follows:
a.domain.com -> 1.1.1.1, 1.1.1.2
And websites as follows:
site1.domain.com -> a.domain.com
site2.domain.com -> a.domain.com
When multiple IPs are bound to the same host some DNS servers will round robin them, and some will not. For example, when I do nslookup on the PC with google's public DNS server (8.8.8.8) I'm getting the following result:
C:\Windows\System32>nslookup site1.domain.com
Server: google-public-dns-a.google.com
Address: 8.8.8.8
Non-authoritative answer:
Name: a.domain.com
Addresses: 1.1.1.1
1.1.1.2
Aliases: site1.domain.com
No matter how many times I execute nslookup, I'm getting the same answer, with IP addresses in the same sequence. But when I do nslookup on the PC that uses local DNS service on the router, sequence of IP addresses changes with each subsequent call:
C:\Windows\System32>nslookup site1.domain.com
Server: UnKnown
Address: 192.168.1.1
Non-authoritative answer:
Name: a.domain.com
Addresses: 1.1.1.1
1.1.1.2
Aliases: site1.domain.com
C:\Windows\System32>nslookup site1.domain.com
Server: UnKnown
Address: 192.168.1.1
Non-authoritative answer:
Name: a.domain.com
Addresses: 1.1.1.2
1.1.1.1
Aliases: site1.domain.com
In my case Windows 8.1 machines were using Google's public DNS server, so all of them were resolving both websites in the same way, always using the first IP gotten - 1.1.1.1. In the other words, both websites were pointing to the same TMG array member 1.1.1.1.
And SSO was working as expected.
On the other side, my Windows 7 machines were setup to dynamically get network settings from the DHCP service (the router), and they were using its DNS service (second example). So when the browser opens site1.domain.com it queries DNS for site1.domain.com,
gets two IPs, as always selects the first one (1.1.1.1), makes request to the first member of my TMG array and successfully creates session. Browser caches site1.domain.com -> 1.1.1.1, so each subsequent call goes to the same address without querying DNS
server. But when the browser opens site2.domain.com it queries DNS server again, this time getting the same IP addresses, but reordered. As always it selects the first one (1.1.1.2), and sends the request (with authentication cookie) to
the second TMG array member. The second TMG validates the cookie and doesn't recognize it, so
rejects it and deletes it, and redirects the browser to login form. Since the cookie is deleted, browser cannot access site1.domain.com (through 1.1.1.1) anymore.
Huuuhhh.
The new question: can SSO be setup with TMG arrays and DNS round robin? Is there any way to "force" array members to accept cookies distributed by other members?
I guess that I must open new question...
Sorry for my stupidity!
Fat Dragon