AD Authenticaton - Trying to Access Sharepoint

[mthurst]

I have been working on this problem with RIM for several months. I cannot authenticate via Blackberry to our SharePoint 2007 site, or any internal site for that matter. Has anyone had any luck?, and if so, I would greatly appreciate some help....:confused.

We have setup a test environment with our SharePoint test server and allowed anonymous users with using BES 5.02, but once we turn off anonymous user we will not be able to authenticate. Any suggestions?

[James Stallings]

What error message do you receive in the blackberry browser?

[mthurst]

Hi James,

HTTP Error 500: Internal Server Error. Sometimes it will prompt you for authentication, but it bombs.

Any suggestions would be well received.

Thanks!

Michele

[gcobb]

Are you using AD across the network?

[mthurst]

Yes we are.

[James Stallings]

This issue was caused by MDS-CS's lack of support for NTLMv2 session security settings. This issue was confirmed using BES 4.1.7 against MOSS 2007.

The NTLMv2 session settings in the local security policy are known as:
- Network security: Minimum session security for NTLM SSP based (including secure RPC) clients
- Network security: Minimum session security for NTLM SSP based (including secure RPC) servers

The SharePoint server was configured to issue NTLM challenges with NTLMv2 session security, but MDS-CS can only craft an NTLM response, which caused authentication with SharePoint to fail.

The workaround that RIM offers is to set each value to no minimum, which may not provide adequate security for some organizations. Our BlackBerry SharePoint solution, SilverDust, uses an authentication architecture that bypasses this issue.

Here is an excellent write up on NTLM and NTLMv2 (including an excerpt on session security) - technet.microsoft.com/en-us/magazine/2006.08.securitywatch.aspx

Note: RIM does have a draft kb built that states the above, but since it hasn't been published publicly, I feel obligated not to post it.