Identify authentication method used by clients when authenticating to Proxy

Article Id: 170550

Status: Published

Updated On: 27-11-2017 23:37

Legacy Id: TECH248265

Products:

ProxySG Software - SGOS

Issue/Introduction:

You want to identify or create a report based on the actual method (Basic, NT Lan Manager - NTLM or Kerberos) negotiated by clients for authentication.

Resolution:

A real time packet capture taken from proxy will indicate the authentication method ultimately selected by clients. But it is a tedious process to search this information in a capture for every user and a pcap buffer is typically too small to leave it running so it is not a viable option in networks with high volume of traffic. The best approach is to include the ELFF (Extended Log File Format) header "x-auth-credential-type" in the access-log.

After adding the field, the access-log will show as below.

2017-11-28 03:53:44 419 10.0.0.1 - - - - NTLM None - authentication_failed PROXIED "Technology/Internet" 2017-11-28 03:53:45 503 10.0.0.1 testuser - purple.com 104.154.170.133 NTLM None - - PROXIED "Technology/Internet" 2017-11-28 03:53:47 426 10.0.0.1 - - - - NTLM None - authentication_failed PROXIED "Web Ads/Analytics" 2017-11-28 03:53:47 243 10.0.0.1 testuser - d.adroll.com 54.248.235.104 NTLM None - - PROXIED "Web Ads/Analytics" 2017-11-28 03:53:50 489 10.0.0.1 testuser - d.adroll.com 54.248.106.94 NTLM None - - PROXIED "Web Ads/Analytics"