Troubleshooting: NTLM Prompt Instead of IWA Redirect Due to Realm-Level URL Rewrite Timing

Version Affected: All
 
 

Overview

When a realm is set up for IWA (WindowsSSO), users on non-Kerberos machines get an NTLM prompt instead of being redirected to a Forms realm for a proper IWA login.

Cause

This happens when the URL Rewrite rule is set at the realm level: it runs after IWA has already processed the request, so the redirect happens too late to prevent the NTLM prompt. The rule needs to be set at the Default Website level instead, so it runs before IWA.

Resolution:

Configure the URL Rewrite rule at the Default Website level:

1. Open IIS Manager and navigate to the Default Website (not the realm).
2. Double-click URL Rewrite and create a new blank rule.
3. For the pattern, set a regular expression matching only your IWA realm's exact name — for example, SecureAuth27(?!\w) if the realm is named SecureAuth27. The (?!\w) negative lookahead prevents the pattern from also matching realms like SecureAuth270 or SecureAuth271.
4. Add a condition based on how you want to distinguish IWA-capable clients from the rest — for example, use {REMOTE_ADDR} if non-IWA machines are on a distinct IP range, or {HTTP_USER_AGENT} if the distinction is based on device type.
5. Set the action type to Redirect.
6. Set the redirect URL to the Forms-based realm you want non-Kerberos clients sent to.
7. Check the box to Append query string.
8. Set the redirect type to Temporary (307).

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.