Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Replies 8 replies
  • Subscribers 0 subscribers
  • Views 4695 views
  • Users 0 members are here
Options
Suggested

[9.270][FEATURE] WAF Prefix not working?

morlin3
Hi all,

we have a test enviroment to test WAF features. We want to have the possiblity to have "domain\username" working. So when I set User Affix to "none" i can login with my testuser called "email" and OWA opens.
If i now change to User Affix "prefix" to "arweb\" (additional tested just "arweb") I get this message:

2014:10:29-10:52:09 TEST reverseproxy: [Wed Oct 29 10:52:09.463472 2014] [authnz_aua:error] [pid 11715:tid 4130544496] [client 172.16.1.40:60823] [arweb\email] AUA responded with 'DENIED', referer: https://email.arweb/owa_owa_form 

2014:10:29-10:52:09 TEST reverseproxy: id="0299" srcip="172.16.1.40" localip="172.20.18.222" size="197" user="arweb\email" host="172.16.1.40" method="POST" statuscode="302" reason="-" extra="-" exceptions="SkipURLHardening, SkipFormHardening, SkipFormHardeningMissingToken" time="45394" url="/owa_owa_login" server="email.arweb" referer="email.arweb/.../owa;httponly;secure" 

2014:10:29-10:52:09 TEST reverseproxy: id="0299" srcip="172.16.1.40" localip="172.20.18.222" size="786" user="-" host="172.16.1.40" method="GET" statuscode="200" reason="-" extra="-" exceptions="SkipURLHardening, SkipFormHardening, SkipFormHardeningMissingToken" time="1892" url="/owa_owa_form" server="email.arweb" referer="email.arweb/owa_owa_form" cookie="-" set-cookie="-" 

2014:10:29-10:52:09 TEST reverseproxy: id="0299" srcip="172.16.1.40" localip="172.20.18.222" size="1502" user="-" host="172.16.1.40" method="GET" statuscode="200" reason="-" extra="-" exceptions="SkipURLHardening, SkipFormHardening, SkipFormHardeningMissingToken" time="1037" url="/REF_RevAutOwa/Screenshotcss.css" server="email.arweb" referer="email.arweb/owa_owa_form" cookie="-" set-cookie="-" 

2014:10:29-10:52:09 TEST reverseproxy: id="0299" srcip="172.16.1.40" localip="172.20.18.222" size="8287" user="-" host="172.16.1.40" method="GET" statuscode="200" reason="-" extra="-" exceptions="SkipURLHardening, SkipFormHardening, SkipFormHardeningMissingToken" time="669" url="/REF_RevAutOwa/company_logo.png" server="email.arweb" referer="email.arweb/owa_owa_form" cookie="-" set-cookie="-" 

Are there additional features to change? seems not to corectly handle the connection via LDAP?
Parents
  • 0
    Hi,

    the WAF prepends the prefix to the username and sends the result as username to the real webserver. Thus, the user does not need to provide the prefix.
    If you have configured a LDAP group with 'userPrincipalname' you have to provide the username in the format 'user@domain'.
    The authentication daemon of the UTM can not handle the format 'domain\user'.

    Sabine
  • 0 in reply to Evianne
    So it is not possible to shorten the login? The support told us it will be possible to perform that with version 9.3.

    200 mobile endpoint use authentification with domain and username which was possible with  TMG. It should be possible to let the UTM ignore the domain and just provide the username?
Reply Children
Unfiltered HTML