This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SSO-AD , user account lock on Win2008/Win7

Hi,

We are using AWG 7.510, and implemented SSO-AD authentication against our win2003 AD domain. This works fine with Winxp and Win 2003 clients.

We are now deploying first Windows 7 ou Win 2008 clients, and we are facing a very weird problem:

On some websites, SSO authentication fails, locks the user account, and a popup is presented to the user. ( our password policy locks the account after 5 attempts)

I insist on the fact that the account is locked BEFORE the popup is presented and the user tries to login.

On the logs i can see:

2012:02:09-13:47:13 AWG01 httpproxy[4569]: [0xae2d2ca0] auth_adir_auth_crap_callback (auth_adir.c:875) Authorization denied (NT_STATUS_WRONG_PASSWORD)
2012:02:09-13:47:13 AWG01 httpproxy[4569]: [0xa927bbf8] auth_adir_auth_crap_callback (auth_adir.c:875) Authorization denied (NT_STATUS_WRONG_PASSWORD)
2012:02:09-13:47:13 AWG01 httpproxy[4569]: [0xad82fe48] auth_adir_auth_crap_callback (auth_adir.c:875) Authorization denied (NT_STATUS_WRONG_PASSWORD)
2012:02:09-13:47:13 AWG01 httpproxy[4569]: [0xa6874f78] auth_adir_auth_crap_callback (auth_adir.c:875) Authorization denied (NT_STATUS_WRONG_PASSWORD)
2012:02:09-13:47:13 AWG01 httpproxy[4569]: [0xb1667b68] auth_adir_auth_crap_callback (auth_adir.c:875) Authorization denied (NT_STATUS_WRONG_PASSWORD)
2012:02:09-13:47:13 AWG01 httpproxy[4569]: [0xa4c80508] auth_adir_auth_crap_callback (auth_adir.c:875) Authorization denied (NT_STATUS_ACCOUNT_LOCKED_OUT)
2012:02:09-13:47:13 AWG01 httpproxy[4569]: [0xa78ac670] auth_adir_auth_crap_callback (auth_adir.c:875) Authorization denied (NT_STATUS_ACCOUNT_LOCKED_OUT)

The problem can be reproduced from any Win7 or Win2008 client, IE or firefox (didn't test other browsers), by going on this page for example :
https://www-304.ibm.com/support/docview.wss?uid=swg27017522

before the complete loading of the page, the account will be locked and an auth pop-up will show.

Thanks for any help.

This thread was automatically locked due to age.

Parents

0 Kisscool over 12 years ago

So, I disabled the AV but no effect on the behavior. I found a little difference between both sites when going to websocket.org/echo.

On UTM 220, I have this :

2013:08:22-17:21:47 fw2n1fr-1 httpproxy[5597]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="CONNECT" srcip="192.168.50.80" dstip="" user="****" statuscode="407" cached="0" profile="REF_HttProDefault (Default)" filteraction=" ()" size="2370" request="0x855cad8" url="echo.websocket.org/" exceptions="" error=""

The request is blocked with Authentication error status.

On ASG320 I have this :

2013:08:22-17:24:21 fw1n1lu-1 httpproxy[6176]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="CONNECT" srcip="192.168.2.92" dstip="174.129.224.73" user="****" statuscode="200" cached="0" profile="REF_IQIPaHnXvX (Default)" filteraction="REF_fJDgikSjOA (IT)" size="1192" request="0x10b75690" url="echo.websocket.org/" exceptions="" error="" category="178" reputation="neutral" categoryname="Internet Services"

The request is OK.

It is the same address, configurations are identical. But something does not work.
Moreover, I do not understand why I see the https request because, the scan is disable for such URL.

Thanks for your reply !

Best,

Reply

0 Kisscool over 12 years ago

So, I disabled the AV but no effect on the behavior. I found a little difference between both sites when going to websocket.org/echo.

On UTM 220, I have this :

2013:08:22-17:21:47 fw2n1fr-1 httpproxy[5597]: id="0002" severity="info" sys="SecureWeb" sub="http" name="web request blocked" action="block" method="CONNECT" srcip="192.168.50.80" dstip="" user="****" statuscode="407" cached="0" profile="REF_HttProDefault (Default)" filteraction=" ()" size="2370" request="0x855cad8" url="echo.websocket.org/" exceptions="" error=""

The request is blocked with Authentication error status.

On ASG320 I have this :

2013:08:22-17:24:21 fw1n1lu-1 httpproxy[6176]: id="0001" severity="info" sys="SecureWeb" sub="http" name="http access" action="pass" method="CONNECT" srcip="192.168.2.92" dstip="174.129.224.73" user="****" statuscode="200" cached="0" profile="REF_IQIPaHnXvX (Default)" filteraction="REF_fJDgikSjOA (IT)" size="1192" request="0x10b75690" url="echo.websocket.org/" exceptions="" error="" category="178" reputation="neutral" categoryname="Internet Services"

Children

No Data