Problem: What are the known issues of using Desktop Authentication feature to automatically log users into the portal?
Cause: Desktop Authentication feature uses Windows Integrated Authentication (NTLMv1). Most browsers do not support auto-login by default and this functionality must be turned on. Some devices also have difficulty connecting and using NTLM authentication. It is recommended that you use standard authentication for client devices you do not control.
Known Issues:
- It is highly recommended you have a separate relay(s) for external users as this setting is configured on a relay because not all client devices will be compatible with NTLM authentication method. If the device is not compatible, the user may not be able to login at all. See #7 and #8 also.
- You may have problems with logins if the client device is not compatible with NTLMv1. Desktop Authentication is based on NTLM authentication and is a feature of both Windows and IE, but it may need to be enabled through local policy and browser settings. Typically Chrome will use IE settings. There are ways to enable this feature in Firefox, but we can not guarantee that this method will always work.
- Users that do not have machines that can properly send the desktop authentication (NTLM) will be prompted with a small pop up box and will have to type in their credentials. This box is not as friendly as the standard login page and thus users might be confused if they are not educated on how-to login.
- You will want to make sure you have workstation security as high as possible because users will now be automatically authenticated into webNetwork just by bringing up the portal URL.
- The logout button will automatically log users back in if you are using Desktop Authentication. This may confuse users if they are not educated.
- Initial login will add extra step of asking for password to be stored in @@password@@ variable, which will then be usable in other features, like file nodes, RDS apps, or webapps. Users will be prompted every time their password changes in AD.
- Active Directory setting User must change password on next login does not function and user will not be able to login when communicating to relay with only desktop authentication enabled (should only effect users on non-domain devices)
- Active Directory password expiration does not function and user will not be able to login when communicating to relay with only desktop authentication enabled (should only effect users on non-domain devices)
- Live Edit feature will not work if you enable desktop authentication.
- wnSSOclient will not work if you enable desktop authentication.
- Cloud Agent / webAgent will not work if you enable desktop authentication.
- WebMenus (legacy feature) will not work if you enable desktop authentication.
- Desktop authentication will not work if any 2-factor authentication is enabled, such as Image Challenge.
Known Configuration Requirements:
- You will need to create a 2nd webNetwork login policy for external relays so users can login to normal webpage
- Windows devices will need to be configured to Send LM & NTLM use NTLMv2 session security if negotiated or LmCompatibilityLevel registry entry set
On the stoneware server, edit stoneware\webnetwork.lax and add -Djcifs.smb.lmCompatibility=0 -Djcifs.smb.client.useExtendedSecurity=false to the end of the line that starts with lax.nl.java.option.additional=
- You may also need to use a pre auth configuration line : -Djcifs.smb.client.username=username -Djcifs.smb.client.password=xxxxxxx -Djcifs.smb.client.domain=customerADdomain
Internet Explorer will need auto-login enabled through Internet Options -> Security -> Local Intranet/Internet zones -> Custom Level... -> User Login -> Login -> Automatic logon with current user name and password
- You will want to add the below login script to detect desktop authentication and if the password needs to be changed.
IF desktopAuthEnabled AND desktopAuthPasswordExpired THEN
executeURL( "/apps/selfService/updateDesktopAuthPassword.jsp", newWindow,title="Desktop Authentication" )
END
Reference(s):
keywords: desktop, desktop auth, windows auth, windows integrated auth, windows authentication, win auth