NTLM Single Sign-On for Internet Access

Set up NTLM-based single sign-on to transparently authenticate on-premises Active Directory users using their Windows logon credentials.

Note:

NTLM-based single sign-on applies only to user devices in an Active Directory domain. Therefore, make sure you have joined desired user devices to your on-premises Active Directory domains.

Consider the following limitations when planning NTLM-based single sign-on:

  • Internet Access cannot authenticate users who do not use the Secure Access Module and connect from outside corporate network locations identified by managed Internet Access Cloud Gateways.

  • If you use an Active Directory Global Catalog server, Internet Access rule mismatch might occur for users with the same user name in your organization.

  1. Go to Zero Trust Secure Access > Secure Access Configuration > Internet Access Configuration > Global Settings, and click Single Sign-On with Active Directory (On-Premises).
  2. Enable NTLM-based single sign-on by selecting Enable single sign-on using NTLM v2 authentication.
  3. Select the type of Active Directory server you want to connect to.
  4. Specify the IP address or FQDN of the Active Directory server.
  5. Protect authentication data during communication with Active Directory by selecting Use LDAPS.
  6. Specify the port for authentication data transmission based on the selected server type and the protocol.

    Protocol

    Microsoft Active Directory

    Microsoft Active Directory Global Catalog

    LDAP

    389

    3268

    LDAPS

    636

    3269
  7. Select an on-premises gateway as the authentication proxy to communicate with Active Directory for authentication.

    All your on-premises Active Directory users are authenticated with the specified on-premises Active Directory server through this gateway.

    Note:

    The on-premises gateway uses listening port 8089 for the authentication.

  8. Avoid certificate warnings on browsers during authentication by selecting and importing a trusted server certificate of your organization.

    By default, Internet Access uses the built-in CA certificate for HTTPS inspection to sign the server certificate for user authentication. To use a Custom certificate, upload your own certificate and private key, and provide the passphrase and confirm passphrase.

    Note:

    Make sure that the Common Name (CN) or Subject Alternative Name (SAN) of the certificate matches the hostname of the selected gateway.

  9. Click Save.

    It might take a few minutes for the configuration to take effect.

  10. Check the setup status in the Gateways screen.

    • Setting up auth proxy: Internet Access is applying the NTLM-based single sign-on settings on the on-premises gateway.

    • Used as auth proxy: The on-premises gateway is successfully configured as the authentication proxy.

    • Auth proxy error: An error occurred when the on-premises gateway attempted to communicate with the Active Directory server or Trend Vision One, or when the Zero Trust Secure Access On-Premises Gateway service is disabled or uninstalled on the Service Gateway appliance or the appliance is disconnected.

  11. Allow automatic logon in Intranet zone by adding the FQDN of the authentication proxy to your Intranet based on the browsers on your users' devices.

    Supported Browser

    Settings

    Mozilla® Firefox®

    1. Open Firefox, type about:config in the address bar, and then click I accept the risk!.

    2. Type network.automatic in the search box and double-click network.automatic-ntlm-auth.trusted-uris.

    3. Type the FQDN of the authentication proxy and click OK.

    Google Chrome™

    Microsoft Edge™ (Chromium-based)

    1. Open Internet Options and click the Security tab.

    2. Select Local intranet and click Sites.

    3. In the Local intranet screen, click Advanced, add the FQDN of the authentication proxy and click Add.

    4. Close the screen.
Parent topic: Active Directory On-Premises Integration and SSO for Zero Trust Secure Access