0

I have a client with set up with Kerberos authentication. Inside their network it works beautifully.

It's a 4 server farm: 2 WFEs behind a load balancer (kemp), 1 App/CA server, 1 Office Web services server.

They have their IE set up to "automatically use current credentials" for the zone their SharePoint URLs are in.

When they take their domain attached laptops off the network and try to log in using IE, it fails instantly with a page cannot be displayed. Using the network debugger, it turns out that they're getting a 401 error, asking for authentication.

Firefox and Chrome work, but they have to log in, presumably because they don't use kerberos and we have NTLM configured as a fallback.

When we examine the firewall logs, there are dropped packets from port 88 trying to reach an AD DC from the test computer we have set up on an external network. It looks like the computer is trying to talk to the DC even though it's outside the network.

Is this expected? Is there something wrong with this configuration?

Improve this question

1 Answer 1

Reset to default
1

it should fail, if i understand correctly. Your stuff is working within network because all users are domain users.Now couple of things:

  • did you DNS( URL) is pulic( access from internet), if not then u need this.
  • In order to kerbrose authentication( domain) working, they should connect to the network i.e VPN. In order to access the AD.
  • You can enable the anonymous access to get it from externally but then site will open to every body...security risk.
  • Another way is configure the Form Based Authentication from external.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.