SSL/TLS filtering blocks HTTP web authentication with NTLM/Negotiate

[cyb 0]

We have an issue were users cannot authenticate on an web page using:

WWW-Authenticate: NTLM
WWW-Authenticate: Negotiate

When accessing the URL, the user gets the credentials prompt from it's browser (Firefox or Chromium) but gets re-prompted (occurs when the server rejects the credentials and tells the browser with a 401 HTTP response which re-ask for credentials).

When I disable the "SSL/TLS filtering" authentication works fine.

I have no issue authenticating on HTTP Basic Auth (WWW-Authenticate: Basic realm="foo").

I am not really used to NTLM authentication: is there something I can configure to keep filtering SSL/TLS but make NTLM auth work?

Using:

• Windows 10 Pro
• ESET Endpoint Security v10.0.2045.0

[itman 1,538]

I assume you are referring to a local web server network connection? If so, refer to this: https://support.eset.com/en/kb7241-resolve-the-intranet-single-sign-on-authentication-issues-with-tls-filtering-activated

[cyb 0]

It a (third-party owned) preproduction/staging web site.

Accessed over the public Internet using a public FQDN (not an IP).

TLS certificates looks OK: issued by Sectigo and USERTrust.

The Qualys SSL Labs tests returns no special error on the certificates (content and path).