Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Content Gateway Security > Content Gateway user authentication > Integrated Windows Authentication
Integrated Windows Authentication
Help | Content Gateway | v8.5.x
Integrated Windows Authentication (IWA) is a robust method of authenticating users who belong to shared-trust Windows domains (one or many).
Integrated Windows Authentication:
*
Uses Kerberos and SPNEGO
*
Supports NTLM in both explicit and transparent proxy modes
*
Supports NTLMv2 and NTLMv1 with Session Security
*
Supports Windows Active Directory. (See this article for a list of supported versions.)
*
Can be used with Rule-Based Authentication and Captive Portal Authentication.
*
Supports Internet Explorer, Firefox, Google Chrome, Windows Safari, Safari on iPad iOS4, and Opera
*
Supports UTF-8 user names
*
Supports fall back to prompted authentication
Requires that:
*
Clients be joined to the domain
*
Client browsers specify the Fully Qualified Domain Name (FQDN) of Content Gateway as an intranet site or trusted site (HTTP://FQDN)
*
When Redirect for HTTPSS Authentication is enabled on the Configure > Security > Access Control > Global Authentication page, Content Gateway will redirect over HTTPS. To avoid user prompts, HTTPS://FQDN must also be specified as an intranet or trusted site in client browsers.
 
* 
Note 
Microsoft Edge does not support trusted sties. Intranet sites are required for clients using Edge.
*
In explicit proxy deployments, browsers must specify the FQDN of Content Gateway
If you are using IWA with rule-based authentication, see Rule-Based Authentication, for configuration steps.
Integrated Windows Authentication: Configuration summary
Follow these steps to configure IWA as the user authentication method for your Content Gateway deployment:
*
In the Content Gateway manager, enable Integrated Windows Authentication on the Configure > My Proxy > Basic page and click Apply.
*
Configure Global authentication options.
*
Join Content Gateway to the Windows domain. See Configuring Integrated Windows Authentication for a list of required conditions.
Configuring Integrated Windows Authentication
1.
Go to Configure > My Proxy > Basic > General. In the Authentication section, click Integrated Windows Authentication On, and click Apply.
2.
Configure the Global authentication options.
3.
Join the Windows domain.
To join the domain:
*
Content Gateway must be able to resolve the domain name.
*
Content Gateway system time must be synchronized with the domain controller's time, plus or minus 1 minute.
*
The correct domain Administrator name and password must be specified.
*
There must be TCP/UDP connectivity to the domain controller(s) (ports 88, 389, 445).
*
If backup domain controllers are configured, they and their Kerberos Distribution Center (KDC) services must be reachable by Content Gateway on the network.
 
a.
In the Domain Name field, enter the fully qualified domain name.
b.
In the Administrator Name field enter the Windows Administrator user name.
c.
In the Administrator Password field enter the Windows Administrator password.
The name and password are used only during the join and are not stored.
d.
Select how to locate the domain controller:
*
Auto-detect using DNS
*
DC name or IP address
If the domain controller is specified by name or IP address, you can also specify backup domain controllers in a comma separated list, no spaces.
e.
In the Content Gateway Hostname field, confirm that the hostname is the correct hostname and that it is no more than 15 characters (no more than 11 characters on appliances). If it is longer, it must be shortened if IWA is to be used. The length restriction results from the 15 character limit on NetBIOS hostnames.
 
* 
Warning 
Do not change the hostname after the domain is joined. If the hostname is changed, IWA immediately stops working and will not work again until the domain is unjoined and then re-joined with the new hostname.
f.
Click Join Domain. If there is an error, ensure that the conditions outlined above are met and then see Failure to join the domain.
 
* 
Important 
All clients subject to authentication must be joined to the domain.
Browsers and other proxy clients must be configured to specify the FQDN of Content Gateway as an intranet site or trusted site.
g.
Restart Content Gateway and run some test traffic through the proxy to verify that authentication is working as expected. If there is a problem, see Troubleshooting Integrated Windows Authentication.
To unjoin the current domain and join a new domain
1.
Navigate to the Configure > Security > Access Control > Integrated Windows Authentication tab and click Unjoin.
2.
To join a new domain, in the Domain Name field, enter the fully qualified domain name.
3.
In the Administrator Name field enter the Windows Administrator user name.
4.
In the Administrator Password field enter the Windows Administrator password. The name and password are used only during the join and are not stored.
5.
Select how to locate the domain controller:
*
Auto-detect using DNS
*
DC name or IP address
If the domain controller is specified by name or IP address, you can also specify backup domain controllers in a comma separated list, no spaces.
6.
Click Join Domain.
To change the way the domain controller is found
1.
Navigate to the Configure > Security > Access Control > Integrated Windows Authentication tab.
2.
In the Domain Controller section, select how to locate the domain controller:
*
Auto-detect using DNS
*
DC name or IP address
If the domain controller is specified by name or IP address, you can also specify backup domain controllers in a comma separated list, no spaces.
3.
Click Apply.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Content Gateway Security > Content Gateway user authentication > Integrated Windows Authentication
Copyright 2023 Forcepoint. All rights reserved.