Using Basic or NTLM for PSC to PO communication

Question

Basic authentication is the easiest to get working, so we generally recommend that users start there, especially when setting up your first IAC environment.  Consider NTLM as a more secure advanced option.
It can be diffcult to troubleshoot the NTLM issues described below, which is why we recommend basic for beginning users.
Now the NTLM option is more secure than basic  authentication, which sends the password in clear text over the wire.   This may not be as much of an issue if you use SSL, but it is certainly  best practice to use both NTLM and SSL.  So in a customer environment,  it is best to work through these concerns to estanblish security.  We  are seeing more and more customers doing security audits, so we will  want to make customer environments use NTLM.
A challenge with NTLM authentication is that the list of supported authentication schemes in the 2 products do not match.
PO uses whatever version of NTLM the domain is using. You can’t actually select v1 or v2. In the future we will make a UI change to indicate that this is vvulnerable to the domain of the account you specify and what version of NTLM it is configured for, but for now you need to undersdtand that. At the end of the day, it’s in PSC where you specify the account which will determine which doimain is used. If you’re using anything newer than W2K8R2, you’re probably running v2, unless you’ve manually set the domain to downlevel (e.g. for legacy application compatibility). PO is at the whim of your authenticating domain as to which version of NTLM will be required.
In PSC, one specifies exactly which NTLM version is to be used in the authentication.
Also, when specifying the connection in IAC of PSC, NTLM is actually NTLM v1, while NTLM is v2. 
So in the IAC configuration wizard, if you are going to use NTLM, you need to specify the NTLM version to match the domain of the user credential you use to connect to PO, specifying NTLM if it is v1 and NTLMv2 if it is v2.

Answer 1

Basic authentication is the easiest to get working, so we generally recommend that users start there, especially when setting up your first IAC environment.  Consider NTLM as a more secure advanced option.
It can be diffcult to troubleshoot the NTLM issues described below, which is why we recommend basic for beginning users.
Now the NTLM option is more secure than basic  authentication, which sends the password in clear text over the wire.   This may not be as much of an issue if you use SSL, but it is certainly  best practice to use both NTLM and SSL.  So in a customer environment,  it is best to work through these concerns to estanblish security.  We  are seeing more and more customers doing security audits, so we will  want to make customer environments use NTLM.
A challenge with NTLM authentication is that the list of supported authentication schemes in the 2 products do not match.
PO uses whatever version of NTLM the domain is using. You can’t actually select v1 or v2. In the future we will make a UI change to indicate that this is vvulnerable to the domain of the account you specify and what version of NTLM it is configured for, but for now you need to undersdtand that. At the end of the day, it’s in PSC where you specify the account which will determine which doimain is used. If you’re using anything newer than W2K8R2, you’re probably running v2, unless you’ve manually set the domain to downlevel (e.g. for legacy application compatibility). PO is at the whim of your authenticating domain as to which version of NTLM will be required.
In PSC, one specifies exactly which NTLM version is to be used in the authentication.
Also, when specifying the connection in IAC of PSC, NTLM is actually NTLM v1, while NTLM is v2. 
So in the IAC configuration wizard, if you are going to use NTLM, you need to specify the NTLM version to match the domain of the user credential you use to connect to PO, specifying NTLM if it is v1 and NTLMv2 if it is v2.