Case where Users are randomly prompted for Authentication while Browsing Internet through ISA Server

[LEFT][CODE]http://blogs.technet.com/isablog/archive/2009/08/18/another-case-where-users-are-randomly-prompt-for-authentication-while-browsing-internet-through-isa-server-2006.aspx[/CODE]
[B][SIZE=3][FONT=Calibri]1. Introduction[/FONT][/SIZE][/B]

[FONT=Calibri][SIZE=3]There are many reasons that users could be prompt for password while browsing Internet through ISA Server. One of the most common scenarios is when ISA Server loses connectivity with Domain Controller and generates the events 5783 and 5719. If this is the case here some articles that can assist you on that:[/SIZE][/FONT]
[URL="http://technet.microsoft.com/en-us/library/bb984870.aspx"][FONT=Calibri][SIZE=3][COLOR=#0000ff]Improving Web Proxy Client Authentication Performance on ISA Server 2006[/COLOR][/SIZE][/FONT][/URL]
[URL="http://blogs.technet.com/isablog/archive/2006/10/05/Troubleshooting-Intermittent-Pop_2D00_up-Credentials-in-ISA-Server-2004-.aspx"][FONT=Calibri][SIZE=3][COLOR=#0000ff]Troubleshooting Intermittent Pop-up Credentials in ISA Server[/COLOR][/SIZE][/FONT][/URL]

[FONT=Calibri][SIZE=3]There are other scenarios where ISA Server does not have performance problems, communication with the Domain Controller is working just fine but the infamous authentication prompt keeps showing up. What could be the reason? Well reason could be on the client workstation, not really on ISA Server. Tom Shinder wrote a very good article about this and shows how to resolve that in this blog post:[/SIZE][/FONT]
[URL="http://blogs.isaserver.org/shinder/2009/04/24/cached-client-credentials-may-cause-unexpected-user-prompts/"][FONT=Calibri][SIZE=3][COLOR=#0000ff]http://blogs.isaserver.org/shinder/2009/04/24/cached-client-credentials-may-cause-unexpected-user-prompts/[/COLOR][/SIZE][/FONT][/URL]

[FONT=Calibri][SIZE=3]As you can see there are many scenarios where the symptom is the same however the root cause is different and this is the goal of this article. The scenario that this article will cover has the same symptom (users being randomly prompt for authentication) however the root cause is different. [/SIZE][/FONT]

[CODE][I][FONT=Calibri][SIZE=3]Note: For the 5783 and 5719 Event ID’s, I was actually able to repro the behavior in a lab and you can see the demo [/SIZE][/FONT][/I][URL="http://www.yuridiogenes.com.br/5783/ISA%20Server.html"][I][FONT=Calibri][SIZE=3][COLOR=#0000ff]here[/COLOR][/SIZE][/FONT][/I][/URL][SIZE=3][FONT=Calibri][I].[/I] [I]This simulation was created using a virtual environment and a tool that emulates network conditions. The result on a real environment could vary. The values showed in the simulation don’t guarantee that on a real environment the issue also will happen. There is no guarantee that you will get the same result trying to simulate the issue on your own.[/I][/FONT][/SIZE][/CODE]

[B][SIZE=3][FONT=Calibri]2. Data Gathering[/FONT][/SIZE][/B]

[FONT=Calibri][SIZE=3]For issues of this nature one of the most recommended action plan to get data is by using ISA Data Packager in repro mode with Web Proxy and Web Publishing Template. For more information on how to use this tool read the article [/SIZE][/FONT][URL="http://blogs.technet.com/yuridiogenes/archive/2009/05/07/using-isabpa-for-proactive-and-reactive-work-with-isa-server-part-2-of-2.aspx"][FONT=Calibri][SIZE=3]here[/SIZE][/FONT][/URL][FONT=Calibri][SIZE=3].[/SIZE][/FONT]

[B][SIZE=3][FONT=Calibri]3. Reviewing Netmon Trace[/FONT][/SIZE][/B]

[FONT=Calibri][SIZE=3]One interesting thing while reading netmon trace was the HTTP response from ISA where it shows the supported authentication methods, has Kerberos, NTLM and Basic authentication (which is not a default authentication method on ISA, integrated only is the default) as shown in figure 1:[/SIZE][/FONT]
[FONT=Calibri][SIZE=3][IMG]http://blogs.technet.com/photos/repository_ii_for_isa_blog_figures/images/3274638/original.aspx[/IMG] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Figure 1 – Authentication negotiation.[/SIZE][/FONT]

[FONT=Calibri][SIZE=3]These methods were sent by ISA because the following authentication methods were selected in the internal network:[/SIZE][/FONT]

[FONT=Calibri][SIZE=3][IMG]http://blogs.technet.com/photos/repository_ii_for_isa_blog_figures/images/3274639/original.aspx[/IMG] [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Figure 2 – Authentication methods selected on the internal network.[/SIZE][/FONT]

[FONT=Calibri][SIZE=3]By un-checking Basic authentication the issue got resolved since it will not fallback to Basic and prompt for authentication in scenarios where integrated was not supported by the application. But then other concerns arise:[/SIZE][/FONT]

[FONT=Symbol][FONT=Calibri][SIZE=3]·[/SIZE][/FONT][/FONT][FONT=Calibri][SIZE=3]What about my non IE browsers that doesn’t support integrated authentication?[/SIZE][/FONT]
[FONT=Symbol][FONT=Calibri][SIZE=3]·[/SIZE][/FONT][/FONT][FONT=Calibri][SIZE=3]What about a third party application that I have that don’t support basic authentication?[/SIZE][/FONT]

[FONT=Calibri][SIZE=3]One thing that is important to remember is that by [I]using basic authentication user’s credentials are transiting in clear text, so it is strongly recommended that you understand the security threat that this type of authentication introduces[/I]. Regardless of the decision that you will make it based on your scenario this important point needs to be considered (unless you use IPSec on your internal network). [/SIZE][/FONT]

[FONT=Calibri][SIZE=3]If you MUST use basic authentication then the troubleshooting steps could be more deep and hard since the reason why the prompt appears is because NTLM (or Kerberos) failed during the negotiation and then ISA Server asked user’s credential using Basic. But why NTLM is failing? It could be because of many elements, since on this specific case ISA is just doing what is suppose to be done, it is time to start narrowing down which client is having this behavior, evaluate case by case and also get data from the client side to understand what is happening. Here are some good references in troubleshooting issues like that on the client side:[/SIZE][/FONT]

[FONT=Calibri][SIZE=3][B]Internet Explorer May Prompt You for a Password[/B][/SIZE][/FONT]
[FONT=Calibri][SIZE=3][URL="http://support.microsoft.com/kb/258063"][COLOR=#0000ff]http://support.microsoft.com/kb/258063[/COLOR][/URL][/SIZE][/FONT]

[FONT=Calibri][SIZE=3][B]Internet Explorer always prompts for authentication when browsing to Web sites already logged on to[/B][/SIZE][/FONT]
[FONT=Calibri][SIZE=3][URL="http://support.microsoft.com/kb/820780"][COLOR=#0000ff]http://support.microsoft.com/kb/820780[/COLOR][/URL][/SIZE][/FONT]

[FONT=Calibri][SIZE=3][B]You may be continually prompted to authenticate in Internet Explorer 6 when you browse Web sites that you already logged on to in Windows Server 2003[/B][/SIZE][/FONT]
[FONT=Calibri][SIZE=3][URL="http://support.microsoft.com/kb/885436"][COLOR=#0000ff]http://support.microsoft.com/kb/885436[/COLOR][/URL][/SIZE][/FONT]

[FONT=Calibri][SIZE=3][B]NTLM Authentication Does Not Work If Internet Explorer Is Configured to Use HTTP 1.1 Through Proxy Connections[/B][/SIZE][/FONT]
[FONT=Calibri][SIZE=3][URL="http://support.microsoft.com/kb/322822"][COLOR=#0000ff]http://support.microsoft.com/kb/322822[/COLOR][/URL][/SIZE][/FONT]


[FONT=Calibri][SIZE=3][B][U]Author[/U][/B][/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Yuri Diogenes[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Sr Security Support Escalation Engineer [/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Microsoft CSS Forefront Edge Team[/SIZE][/FONT]

[FONT=Calibri][SIZE=3][B][U]Technical Reviewer[/U][/B][/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Thomas Detzner[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Escalation Engineer[/SIZE][/FONT]
[FONT=Calibri][SIZE=3]Microsoft Forefront Edge Team[/SIZE][/FONT]
[/LEFT]