<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I posted this a few weeks ago – I hope it helps you. I did this with nginx plus, so it may not work if you are using the open-source product.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoPlainText">NTLM authentication authenticates connections instead of requests, and this is somewhat contradicts HTTP protocol, which is expected to be stateless. As a result it doesn't generally work though proxies, including nginx.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">NGINX can support it though, you need to use the "ntlm" directive. Below is an [stripped down] example of how I have it set up in front of TFS. I would think Sharepoint would be very similar. This has worked very reliably for like
a year.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">upstream MyNtlmService {<o:p></o:p></p>
<p class="MsoPlainText"> zone backend;<o:p></o:p></p>
<p class="MsoPlainText"> server 192.168.0.1:8080;<o:p></o:p></p>
<p class="MsoPlainText"> server 192.168.0.2:8080;<o:p></o:p></p>
<p class="MsoPlainText"> #See <a href="http://stackoverflow.com/questions/10395807/nginx-close-upstream-connection-after-request">
http://stackoverflow.com/questions/10395807/nginx-close-upstream-connection-after-request</a><o:p></o:p></p>
<p class="MsoPlainText"> keepalive 64;<o:p></o:p></p>
<p class="MsoPlainText"> #See <a href="http://nginx.org/en/docs/http/ngx_http_upstream_module.html#ntlm">
http://nginx.org/en/docs/http/ngx_http_upstream_module.html#ntlm</a><o:p></o:p></p>
<p class="MsoPlainText"> ntlm;<o:p></o:p></p>
<p class="MsoPlainText">}<o:p></o:p></p>
<p class="MsoPlainText"> server {<o:p></o:p></p>
<p class="MsoPlainText"> listen 80;<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> location / {<o:p></o:p></p>
<p class="MsoPlainText"> proxy_read_timeout 60s;<o:p></o:p></p>
<p class="MsoPlainText"> #http://stackoverflow.com/questions/21284935/nginx-reverse-proxy-with-windows-authentication-that-uses-ntlm<o:p></o:p></p>
<p class="MsoPlainText"> proxy_http_version 1.1;<o:p></o:p></p>
<p class="MsoPlainText"> proxy_set_header Connection "";<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> proxy_pass http:// MyNtlmService /;<o:p></o:p></p>
<p class="MsoPlainText"> }<o:p></o:p></p>
<p class="MsoPlainText"> }<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> nginx [mailto:nginx-bounces@nginx.org]
<b>On Behalf Of </b>Payam Chychi<br>
<b>Sent:</b> Friday, February 23, 2018 8:05 AM<br>
<b>To:</b> nginx@nginx.org<br>
<b>Subject:</b> [IE] Re: NTLM sharepoint when use nginx reverse proxy<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, Feb 23, 2018 at 4:32 AM Francis Daly <<a href="mailto:francis@daoine.org">francis@daoine.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal">On Fri, Feb 23, 2018 at 04:15:31AM -0500, sonpg wrote:<br>
<br>
Hi there,<br>
<br>
> myserver requires NTLM authentication. I access myserver through nginx proxy<br>
> and provide correct auth info,but the browser prompt auth again.<br>
<br>
<a href="http://nginx.org/r/ntlm" target="_blank">http://nginx.org/r/ntlm</a><br>
<br>
nginx does not support NTLM authentication.<br>
<br>
If you need something to reverse-proxy a http server that uses NTLM, you<br>
must write the code to make your nginx do it, or you must use something<br>
that is not stock-nginx.<br>
<br>
If you choose the latter, "NGINX Plus" is one thing that does advertise<br>
NTLM support. Other things probably exist too.<br>
<br>
f<br>
--<br>
Francis Daly <a href="mailto:francis@daoine.org" target="_blank">francis@daoine.org</a><br>
_______________________________________________<br>
nginx mailing list<br>
<a href="mailto:nginx@nginx.org" target="_blank">nginx@nginx.org</a><br>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx" target="_blank">http://mailman.nginx.org/mailman/listinfo/nginx</a><o:p></o:p></p>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Pass it to squid for NTLM auth<o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<p class="MsoNormal">Payam Tarverdyan Chychi<br>
Network Security Specialist / Network Engineer<o:p></o:p></p>
</div>
</div>
This message contains proprietary information from Equifax which may be confidential. If you are not an intended recipient, please refrain from any disclosure, copying, distribution or use of this information and note that such actions are prohibited. If you
have received this transmission in error, please notify by e-mail postmaster@equifax.com. Equifax® is a registered trademark of Equifax Inc. All rights reserved.
</body>
</html>