NTLM fails authenticating with the service account in windows 2008 r2

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 5.2.3, 6.0.5 GA
• Fix Version/s: 6.0.12 EE, 5.2.X EE
• Component/s: Authentication
• Labels:
  • QA-R
• Environment: 6.0.x, 5.2.x
• Branch Version/s:
  5.2.x, 6.0.x
• Backported to Branch:
  Committed
• Similar Issues: Show 5 results ; ;

  LPS-33491	LDAP Server with NTLM compatibility level 5 fails LDAP import and SSO sign-in
  LPS-625	Problem with NTLM Authentication
  LPS-29930	Create authentication endpoints for web services authentication process
  LPS-24538	Liferay 6.1.x Bundle Tomcat 7.x has no "service.bat" to create a windows service for win server 2008 64 bit
  LPS-22375	Ntlm authentication with Firefox or Chrome

NTLM fails authenticating with the service account in windows 2008 r2

High level steps to reproduce:
1) Setup windows2008 r2 server, with a domain/active directory configured
2) Create computer account, follow steps from: http://www.ioplex.com/d/Jespa_Operators_Manual.pdf (section: Create the Computer Account for NETLOGON Communication)
3) Setup LDAP/NTLM settings in Liferay to point to the windows2008 r2 server
4) Attempt to log in to Liferay via NTLM
5) You should receive in the stacktrace, "Session key negotiation failed"

[Wesley Gong]

Marcellus discovered that we had enabled all flags in the negotiation process between Liferay and NTLM which windows2008 r2 disallowed. In order to resolve this, we disabled some of the bits based on the specifications presented in the below document:

http://download.microsoft.com/download/a/e/6/ae6e4142-aa58-45c6-8dcf-a657e5900cd3/%5BMS-NLMP%5D.pdf

[Sonia Predieri]

We have the same problem on liferay 6.0.5 GA and Active Directory on Windows 2008 Server R2;
we receive an "Session key negotiation failed" exception when liferay try to authenticate on ldap with the Computer Account that we have created.

We want to know if we can fix this bug in our enviroment.

[Yves LeGrand]

Hi @all.
We are facing the same issue with liferay 6.0.6 CE GA and AD, NTLM on Windows 2008 R2.
What are the necessary steps to solve this issue? Thanks.

[Paul Piao]

FAILED Manual Testing following steps in description.

Reproduced on:
Tomcat 6.0 + MySQL 5. Firefox 4.0.1. 6.0.5 GA.
Tomcat 6.0 + MySQL 5. Firefox 4.0.1. 5.2.3 CE.

Failed on:
Tomcat 6.0 + MySQL 5. Firefox 4.0.1. Trunk Revision 80911.
Tomcat 6.0 + MySQL 5. Firefox 4.0.1. 5.2.x Revision 80911.

[Berndt Krieger]

After patching our DC to 2008 R2 we had the same problem. I solved it by modifying
com.liferay.portal.security.ntlm.NetlogonConnection:

...
NetrServerAuthenticate3 netrServerAuthenticate3 =
new NetrServerAuthenticate3(
domainControllerName, ntlmServiceAccount.getAccountName(), 2,
ntlmServiceAccount.getComputerName(), clientCredential,
NetrServerAuthenticate3 netrServerAuthenticate3 =
new NetrServerAuthenticate3(
domainControllerName, ntlmServiceAccount.getAccountName(), 2,
ntlmServiceAccount.getComputerName(), clientCredential,
old:
<
new byte[8], 0xFFFFFFFF);
>
new
<
new byte[8], 0x6013C600);
>
...

description of the flags can be found here:

http://msdn.microsoft.com/en-us/library/cc704291%28PROT.10%29.aspx

[Paul Piao]

PASSED Manual Testing following steps in description.

Reproduced on:
Tomcat 6.0 + MySQL 5. Firefox 4.0.1. 6.0.5 GA.
Tomcat 6.0 + MySQL 5. Firefox 4.0.1. 5.2.3 CE.

Fixed on:
Tomcat 6.0 + MySQL 5. Firefox 4.0.1. Trunk Revision 82809.
Tomcat 6.0 + MySQL 5. Firefox 4.0.1. 5.2.x Revision 82809.

Thanks Wesley,

[Vicki Tsang]

This is being bulk closed in preparation for the new workflow.

[Rushikesh Kulkarni]

Hello,

I am new with lifeRay and configuring NTLM. I am facing exactly the same issue.
Can you please tell me how to modify NetLogOnConnection to set the flags as mentioned above ?

I downloaded the source for portal-impl, but i am not able to build it on my local.

Thanks for your time.

[Rushikesh Kulkarni]

I am using LifeRay 6.0.6.

[Rushikesh Kulkarni]

I am using LifeRay 6.0.6.

[Priyanka Matai]

Hello Berndt,

We are in the same siutation as yours and need to apply the fix that has been outlined in your post.

Could you be kind enough to advise how you went about this change.

Thanks, Priyanka.