nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

TeamSite Authentication !!!

Ambuj

Users on certain domains are not able to access any workarea because TeamSite is unable to authenticate them. We are interacting with IWOV and the most likely cause we have got is application is not able to work in an environment which uses NTLM and active directory protocols at the same time.

Do you know any document / knowledge article which talks about network architecture / TeamSite authentication in details?

Find more posts tagged with

Comments

stefanmaier

Hi,
can you give some more information about your environment?
- did you try to access a workarea with a local user?
- do you use domain groups or server local groups as workarea shared groups?
- are your domain users a direct member of your workarea shared group or do you use nested groups?

And also:
- did you check your domain_list value in section [iwserver] in iw.cfg?
- did you try to get some debug user information through the show_user_list=true key in the iw.cfg?

Regards
Stefan

Ambuj

Hi,
can you give some more information about your environment?
- did you try to access a workarea with a local user?
- do you use domain groups or server local groups as workarea shared groups?
- are your domain users a direct member of your workarea shared group or do you use nested groups?

And also:
- did you check your domain_list value in section [iwserver] in iw.cfg?
- did you try to get some debug user information through the show_user_list=true key in the iw.cfg?

Regards
Stefan

Here is the information you needed..

- local user is able to access the workarea
- we use both domain groups as well as server local groups. problem we are facing is with some specific domain groups
- generally its nested but even if we are adding direct members it's not working

- domains are added to domain_list in [iwserver] iw.cfg
- we didn't get debug information by show_user_list. let me know how it can help?

nbwoven

I think you're already aware of the NTLM issues on TS671 .

Teamsite uses the Windows system call "LogonUser()" to authenticate TeamSite users. This call uses either NTLM(Windows NT4 -legacy) or Active Directory(Kerberos 2000 & 2003-new), depending on how the machine that TeamSite is running on is configured .

After the initial authentication, TeamSite writes a cookie to the browser that is used to identify that user for the rest of the session. Currently, Kerberos is the only means of authentication Teamsite support for TeamSite -671(+SP1).
as NTLM support was dropped .

Approach your IT Guys to disable NTLM(through registry) on this Server .

stefanmaier

Hello,
the show_user_list key gives you some information about the windows groups assigned to a user object.
Perhaps you can see, if there're some inconsistencies...

Regards
Stefan

Excel_export_report.rptdesign

Ambuj

I think you're already aware of the NTLM issues on TS671 .

Teamsite uses the Windows system call "LogonUser()" to authenticate TeamSite users. This call uses either NTLM(Windows NT4 -legacy) or Active Directory(Kerberos 2000 & 2003-new), depending on how the machine that TeamSite is running on is configured .

After the initial authentication, TeamSite writes a cookie to the browser that is used to identify that user for the rest of the session. Currently, Kerberos is the only means of authentication Teamsite support for TeamSite -671(+SP1).
as NTLM support was dropped .

Approach your IT Guys to disable NTLM(through registry) on this Server .

Thanks for the information but is it applicable for TS6.5 also. I mean NTLM is not supported on TS671 onwards or it's TS65 onwards?

Ambuj

I had one more query?

How does Teamsite check group membership? Does it rely on Windows mechanism? Or does it use some own mechanism?

Adam Stoller

I had one more query?

How does Teamsite check group membership? Does it rely on Windows mechanism? Or does it use some own mechanism?

I believe it uses OS library calls like getgrent (UNIX, not sure if it exists on Windows) - though it's possible it may be intercepting such calls when made within the IFS so that it can handle memberships in TS groups...