Administrator's Guide - Kerio Software Archive

Specific settings and troubleshooting
The login dialog is displayed only if NTLM authentication fails (e.g. when user account
for user authenticated at the client host does not exist in Kerio Control).
Warning:
One reason of a NTLM authentication failure can be invalid login username or
password saved in the Password Manager in Windows operating systems (Control
Panels → User Accounts → Advanced → Password Manager) applying to
the corresponding server (i.e. the Kerio Control host). In such a case, Internet
Explorer sends saved login data instead of NTLM authentication of the user
currently logged in. Should any problems regarding NTLM authentication arise, it
is recommended to remove all usernames/passwords for the server where Kerio
Control is installed from the Password Manager.
Firefox/SeaMonkey
The browser displays the login dialog. For security reasons, automatic user
authentication is not used by default in the browser. This behavior of the browser can be
changed by modification of configuration parameters — see below.
If authentication fails and direct connection is applied, the firewall’s login page is opened
automatically (refer to chapter 12.2). The login dialog is displayed if proxy server is used.
Note: If NTLM authentication fails by any reason, details are recorded in the error log (see
chapter 22.8).
Firefox/SeaMonkey configuration
Configuration can be changed to enable automatic NTLM authentication — leaving out the
login dialog. Check the following example:
1. Insert about:config in the browser’s address bar. The list of configuration parameters is
displayed.
2. Set corresponding configuration parameter(s) using the following instructions:
• For direct connection (proxy server is not set in the browser):
Look up the network.automatic-ntlm-auth.trusted-uris parameter. Use
the Kerio Control host’s name as a value for this parameter (e.g. server or
server.company.com). This name must match the server name set under Configuration
→ Advanced Options → Web Interface (see chapter 12.1).
Note: It is not possible to use IP address as a value in this parameter!
• If Kerio Control proxy server is used:
Look up the network.automatic-ntlm-auth.allow-proxies parameter and set
its value to true.
Configuration changes are applied right away, i.e. it is not necessary to restart the browser.
368