nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Active Directory / NTLM - Users Still Queried for Login/Password/Domain

Jim_Justice_(eu0014205user1_-_(deleted))

I have set up NTLM synchronization with the AD domain. Whenever a user goes to our Livelink web server, they are queried for username, password and domain by a challenge/response window. Is this the expected behavior? Shouldn't the system be able to determine this information if they are logged into the domain from a computer on the domain (I understand it shouldn't work if authentication information is not being passed, such as in the case of our VPN setup).Thanks in advance for any advice,Taz

Find more posts tagged with

Comments

Robert_Gaines

Message from Horner Charles W Contr 46 TW/XPI <charles.horner@eglin.af.mil> via eLink

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">RE: Active Directory / NTLM - Users Still Queried for Login/Password/Domain

Sounds like you will need to add your Livelink URL to each users trusted sites section in the browser.
Open Tools, Internet Options, Security and click on Trusted Sites. Click the Sites button and add the livelink URL.
Hope this helps..
Chuck

-----Original Message-----
From: eLink Discussion: Livelink Directory Services Discussion [mailto:directoryservices@elinkkc.opentext.com]
Sent: Tuesday, June 22, 2004 1:31 PM
To: eLink Recipient
Subject: Active Directory / NTLM - Users Still Queried for Login/Password/Domain

Active Directory / NTLM - Users Still Queried for Login/Password/Domain Posted by Lake, Taz on 06/22/2004 02:26 PM

Thanks in advance for any advice,
Taz

[To reply to this thread, use your normal E-mail reply function.]

============================================================

Discussion: Livelink Directory Services Discussion https://knowledge.opentext.com/knowledge/livelink.exe?func=ll&objId=3062146&objAction=view

Livelink Server: https://knowledge.opentext.com/knowledge/livelink.exe

Santiago_Guzman_(sguzman_-_(deleted))

Message from Guzman, Santiago <Santiago.Guzman@Infineum.com> via eLink

eLink

Are you using IIS? If so you need to turnoff Anonymous access and leave Integrated Windows authentication.

If you not using IIS you will need to setit to basic authentication andturnoff everything else.

Santiago_Guzman_(sguzman_-_(deleted))

Message from Guzman, Santiago <Santiago.Guzman@Infineum.com> via eLink

eLink

Are you using IIS? If so you need to turnoff Anonymous access and leave Integrated Windows authentication.

If you not using IIS you will need to setit to basic authentication andturnoff everything else.

Jim_Justice_(eu0014205user1_-_(deleted))

Thanks for the response, this is how the IIS configuration is set, that's why I'm a bit confused. If Integrated Windows Authentication is on, why are users queried for login/password/domain even though they are logged into a client machine on the network. I guess I'll be e-mailing support next ;-)I haven't tried adding the site as a trusted site, as suggested earlier.

Santiago_Guzman_(sguzman_-_(deleted))

Message from Guzman, Santiago <Santiago.Guzman@Infineum.com> via eLink

eLink

Is the NT permission of the OpenText folderset to allow authenticated users to read and execute?

Jim_Justice_(eu0014205user1_-_(deleted))

Yes, it is actually set to allow everyone read and execute permissions. Apparently this is how the OT consultants set it up.

Krishnankutty_Nair

I am not much of a network auth expert but hope screenshots help.This is accessed by rightclicking the properties of your webserver on which livelink runs and selecting Directory Security.When you hit the edit button on your basic authentication you need to specify thedomain on which your webserver is on.Now you are telling the webserver that authenticate any users who are coming from our fictitious realm "opentext" based on NTLM.To this effect I hope that you have talked to your network guys who have made your client domains have an existing trust with the "opentext" realm.Also rule out the possibility of a microsoft office idiosyncracy.Test your LDAP auth with a link to a livelink folder.When you test with a document such as doc and xls then you have the additional overhead of how livelink hands over creds to the app and that is a whole different story.But basically NTLM is supposed to work like thisClient hits livelink webserver.Webserver authenticates clients credentials against his contolling directory service.If client record is found pass request to livelink cgi.livelink verifies user record against its own database and voila.

Geoff_Obbard

Message from Geoff Obbard <gobbard@opentext.com> via eLink

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">eLink

Hi Taz,

Internet Explorer only submits credentials automatically under very specific circumstances. The most common reasons that IE won't automatically submit credentials for you are that automatic logon is not enabled, or that the site requesting authentication is not in the Local Intranet zone.

To check that Automatic logon is enabled for the Local Intranet zone:

1. Open Internet Explorer, select Tools | Internet Options... | Security.

2. Select the "Local intranet" zone.

3. Click "Custom Level..."

4. Scroll down to the "User Authentication" section.

5. Verify that "Automatic logon only in Intranet zone" is selected.

To check that the site requesting authentication is in the Local Intranet zone:

1. Open Internet Explorer, select Tools | Internet Options... | Security.

2. Select the "Local intranet" zone.

3. Click "Sites..."

4. Click "Advanced..."

5. Enter the URL to your server (e.g.: yoursite.yourdomain.com) and click "Add"

Once you have verified these settings, the zone entry on the status bar should show "Local Intranet".

Microsoft Knowledge Base article 258063 describes this issue in more detail.

Geoff

Jim_Justice_(eu0014205user1_-_(deleted))

Geoff, thanks for the feedback. Adding the site to the local Intranet Zone works. I didn't check Chuck's idea about adding it to the trusted sites zone, but my guess is that would also work.I wish this could be done on the server side, because now I have to have every user of the system do this. At least it will save them time in the future. Thanks again for your help.Taz