How to configure Access Gateway Windows Authentication when there are multiple AD domains

Products

• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)
• SITEMINDER
• CA Single Sign-On

Issue/Introduction

This is to demonstrate how the Access Gateway Windows Authentication need to be configured to login multiple domain users.

 

Environment

Release : 12.8.x

Resolution

SM2.lab.local (192.168.100.12)

 

 

SM1.snow.mt (192.168.100.11)

Above trust relationship means SNOW domain users can access/login to LAB domain resources/applications.

 

For example, SNOW\testuser can access http://sps.lab.local:81/protected/ application using Windows Authentication.

This is even when SiteMinder is NOT involved.

 

 

SPS.LAB.LOCAL (192.168.100.13)

NOTE: IIS Application is installed on this machine to reduce the number of machines involved.

This machine has joined LAB domain (it also means this machine is pointing to 192.168.100.12 as the DNS server.

At the SiteMinder AdminUI, both AD must be registered with respective domain accounts.

 

IIS is installed on this SPS machine listening on port 81.

Windows Authentication module is not required for Access Gateway's Windows Authentication as it is independent and does not require IIS.

 

 

WIN10a.LAB.LOCAL (192.168.100.14)

This machine joins LAB domain (DNS is set to 192.168.100.12)

 

Logon as SNOW\testuser, if this fails then there is misconfiguration. Please review the above steps again.

 

In the Internet Options, "*.lab.local" is set to "Local intranet" zone.

 

Following is to verify that SNOW domain users can access LAB domain applications. In the above step, SNOW domain user logon to LAB domain joined machine already confirms this but this is for application side perspective.

On the SPS.LAB.LOCAL machine where IIS is installed, add "Windows Authentication"

 

Now from the WIN10a.LAB.LOCAL machine, use MS EDGE browser to access http://sps.lab.local:81/protected/ which is only accessible to those who can authenticate themselves via Windows Authentication.

The RED box shows the authenticated user.

The purple box shows the NT Authorization Token used for Windows Authentication.

 

And IIS log also confirms this.

2023-06-28 04:39:52 192.168.100.13 GET /protected/ - 81 SNOW\testuser 192.168.100.14 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/89.0.4389.114+Safari/537.36+Edg/89.0.774.68 - 200 0 0 344

 

 

Now, removing the Windows Authentication module from the IIS as this was just for proof of concept purpose.

No harm in keeping the Windows Authentication on this IIS machine.

 

 

 

Above is the prerequisite before introducing SiteMinder.

 

--------------------------------------------------------------

SiteMinder Integration Steps

 

1. Create agent/ACO/HCO for the Access Gateway that will be installed on the SPS.LAB.LOCAL machine.

Make sure WindowsNativeAuthentication is set to "no"

Good to enable agent logs.

 

2. Create Windows Authentication Scheme

3. Create user stores for both LAB and SNOW domain using the respective domain accounts.

View contents must work!

 

4. Create Domain/Realm/Rule/Policy to protect http://sps.lab.local/html/ using Windows Authentication Scheme allowing the following users.

 

5. Logon to WIN10a.LAB.LOCAL as SNOW\testuser and open MS EDGE browser to navigate to http://sps.lab.local/html/

Use wireshark to capture the network packets (Chrome/Edge developer mode does not seem to capture the data correctly)

 

 

Use Telerik fiddler to capture the header (do not use chrome/edge developer mode as they don't capture the events correctly) or use wireshark if HTTP is in use.

 

 

 

You can see here the Authorization header is being submitted to SPS.

Authorization: Negotiate TlRMTVNTUAADAAAAGAAYAHwAAAAWARYBlAAAAAgACABYAAAAEAAQAGAAAAAMAAwAcAAAABAAEACqAQAAFYKI4goAYUoAAAAPLLupATp1e7bIqMnivDkchVMATgBPAFcAdABlAHMAdAB1AHMAZQByAFcASQBOADEAMABBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIKxWsLBPcohChS+V1iN/3IBAQAAAAAAAE8K6cWAqdkBN3AD1NORC9YAAAAAAgAGAEwAQQBCAAEABgBTAFAAUwAEABIAbABhAGIALgBsAG8AYwBhAGwAAwAaAHMAcABzAC4AbABhAGIALgBsAG8AYwBhAGwABQASAGwAYQBiAC4AbABvAGMAYQBsAAcACABPCunFgKnZAQYABAACAAAACAAwADAAAAAAAAAAAQAAAAAgAADwH5DZxyU6Jk9UslJRd0T9mm0zFX9xUXWCLv7ryfXbuwoAEAAAAAAAAAAAAAAAAAAAAAAACQAkAEgAVABUAFAALwBzAHAAcwAuAGwAYQBiAC4AbABvAGMAYQBsAAAAAAAAAAAA68DMaXYziCgnlpJovWvfGQ==

 

Webagenttrace.log

[06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProcessAdvancedAuthentication][Start new request.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmResourceManager::ProcessAdvancedAuthResource][Calling SM_WAF_HTTP_PLUGIN->ProcessAdvancedAuthResource.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmHttpPlugin::ProcessAdvancedAuthResource][Resolved HTTP_HOST: 'sps.lab.local'.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][][Entered CSmHttpPlugin::ResolveFQServerName sHost: ][sps.lab.local] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmHttpPlugin::ResolveClientIp][Resolved Client IP address '192.168.100.14'.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][SmAdvancedAuthCore::parseTargetUrl][Resolved cookie domain '.lab.local'.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmResourceManager::ProcessAdvancedAuthResource][SM_WAF_HTTP_PLUGIN->ProcessAdvancedAuthResource returned SmSuccess.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmResourceManager::ProcessAdvancedAuthResource][Calling SM_WAF_AG_PLUGIN->ProcessAdvancedAuthResource.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmResourceManager::ProcessAdvancedAuthResource][SM_WAF_AG_PLUGIN->ProcessAdvancedAuthResource returned SmNoAction.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][IsResourceProtected][Resource is protected from cache.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProcessResponses][Calling SM_WAF_HTTP_PLUGIN->ProcessResponses.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmHttpPlugin::ProcessResponses][Processing IsProtected responses.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProcessResponses][SM_WAF_HTTP_PLUGIN->ProcessResponses returned SmSuccess.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProcessResponses][Calling SM_WAF_AG_PLUGIN->ProcessResponses.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProcessResponses][SM_WAF_AG_PLUGIN->ProcessResponses returned SmNoAction.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmCredentialManager::GatherAdvancedAuthCredentials][Calling SM_WAF_HTTP_PLUGIN->ProcessAdvancedAuthCredentials.] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][SmNtc::getCredentials][user-agent received Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 Edg/89.0.774.68] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][SmNtc::getCredentials][Request for  SSPI NTLM using NTLM Map] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][SmNtc::getCredentialsNTLMMap][  SMNTLMCOOKIE  Cookie ID 16994fea-7f1a0249-7b9250e1-3d026a88-7b363948-760          ] [06/27/2023][22:24:12][22:24:12.543][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][SmNtc::getCredentialsNTLMMap][ SMNTLMCOOKIE TYPE 3 ] [06/27/2023][22:24:12][22:24:12.543][1520][6280][][CSmSSPIServer::processNTLMRequest][Calling AcceptSecurityContext with handle: (lower) 1461524721376 (upper) 2142396205232] [06/27/2023][22:24:12][22:24:12.543][1520][6280][][CSmSSPIServer::processNTLMRequest][Handle is valid] [06/27/2023][22:24:12][22:24:12.558][1520][6280][][CSmSSPIServer::processNTLMRequest][AcceptSecurityContext returned : 0x00000000] [06/27/2023][22:24:12][22:24:12.558][1520][6280][][CSmSSPIServer::processNTLMRequest][Returned from AcceptSecurityContext with handle: (lower) 1461524721376] [06/27/2023][22:24:12][22:24:12.558][1520][6280][][CSmSSPIServer::processNTLMRequest][Returned from AcceptSecurityContext with handle: (upper) 2142396205232] [06/27/2023][22:24:12][22:24:12.558][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][SmNtc::getCredentialsNTLMMap][NTLM Authentication request is successfully completed for user SNOW\testuser.] [06/27/2023][22:24:12][22:24:12.558][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][HandleCredCollectorReturn][POST preservation, handling return from credential collector.] [06/27/2023][22:24:12][22:24:12.558][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][HandleCredCollectorReturn][http response http://sps.lab.local/html/] [06/27/2023][22:24:12][22:24:12.558][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmCredentialManager::GatherAdvancedAuthCredentials][SM_WAF_HTTP_PLUGIN->ProcessAdvancedAuthCredentials returned SmSuccess.] [06/27/2023][22:24:12][22:24:12.558][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmCredentialManager::GatherAdvancedAuthCredentials][Calling SM_WAF_AG_PLUGIN->ProcessAdvancedAuthCredentials.] [06/27/2023][22:24:12][22:24:12.558][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmCredentialManager::GatherAdvancedAuthCredentials][SM_WAF_AG_PLUGIN->ProcessAdvancedAuthCredentials returned SmNoAction.] [06/27/2023][22:24:12][22:24:12.558][1520][6280][][Sm_AgentApi_Login][Enter function Sm_AgentApi_Login] [06/27/2023][22:24:12][22:24:12.558][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][Sm_AgentApi_Login][] [06/27/2023][22:24:12][22:24:12.590][1520][6280][][Sm_AgentApi_Login][Leave function Sm_AgentApi_Login] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][AuthenticateUser][User 'SNOW\testuser' is authenticated by Policy Server.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][][Sm_AgentApi_FreeAttributes][Enter function Sm_AgentApi_FreeAttributes] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProcessResponses][Calling SM_WAF_HTTP_PLUGIN->ProcessResponses.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmHttpPlugin::ProcessResponses][Processing Authentication responses.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmHttpPlugin::GenerateNTCChallengeDoneCookie][Generating SMCHALLENGE=NTC_CHALLENGE_DONE set-cookie response header.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProcessResponses][SM_WAF_HTTP_PLUGIN->ProcessResponses returned SmSuccess.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProcessResponses][Calling SM_WAF_AG_PLUGIN->ProcessResponses.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProcessResponses][SM_WAF_AG_PLUGIN->ProcessResponses returned SmNoAction.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmSessionManager::CreateSession][Calling SM_WAF_HTTP_PLUGIN->CreateSession.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmHttpPlugin::CreateSession][Generated SMSESSION cookie.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmSessionManager::CreateSession][SM_WAF_HTTP_PLUGIN->CreateSession returned SmSuccess.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmSessionManager::CreateSession][Calling SM_WAF_AG_PLUGIN->CreateSession.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][CSmSessionManager::CreateSession][SM_WAF_AG_PLUGIN->CreateSession returned SmNoAction.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProcessAdvancedAuthentication][End new request.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][][ReportHealthData][Accumulating HealthMonitorCtxt.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][Tomcat5SerializedAgentData::doResponse][HTTP Status Code = 302] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProxyValve::invoke][Exit status returned from the agent.] [06/27/2023][22:24:12][22:24:12.590][1520][6280][17e714fa-bca2668d-6bfb0b33-394cec1e-b56da574-d740][ProxyValve::invoke][Leaving the agent.]

 

 

Windows event log (Security) at the SNOW domain controller.

 

Policy Server smaccess.log

AuthAccept SM2 [27/Jun/2023:22:24:12 -0700] "192.168.100.14 CN=Snow White,OU=TEST,DC=SNOW,DC=MT" "agent.sps GET /html/" [idletime=3600;maxtime=7200;authlevel=5;] [0]  [] [] [] AzAccept SM2 [27/Jun/2023:22:24:12 -0700] "192.168.100.14 CN=Snow White,OU=TEST,DC=SNOW,DC=MT" "agent.sps GET /html/" [17eae8ea-a74cb58e-5bedb1c6-1528200c-06462e44-3cba] [0]  [] [] []