If you are trying to pre-authenticate your connection to the ISA
server and then forward those credentials to the VisualSVN Server you
are running into a limitation of NTLM authentication.  A NTLM session
is unable to be forward (a.k.a delegated) from ISA to another server
because the NTLM authentication session is unique between the client
and the ISA server.  In other words, a NTLM authentication from client
to ISA can't be proxied to the VisualSVN server.  I would guess that
Basic Authentication would work since that can be delegated to the
VisualSVN server but you should not be doing this without SSL.  Worst
case is to use a self-signed ssl certificate.

If you must insist on using integrated credentials then you will need
to make sure both your ISA server and your VisualSVN server are domain
joined (in the same domain in fact) and then configure the ISA server
to be allowed to delegate the (kerberos) credentials to the VisualSVN
server.  This is referred to as Kerberos Constrained Delegation
(KCD).  There are several articles out there on how to configure KCD
that should help you but if you get into trouble I can provide
additional info.

My recommendation is to not use pre-authentication at the ISA level,
just leave it to the VisualSVN process.  Just configure the Publishing
Rule so that ISA send the authentication request back to the client
instead of handling it itself.

Chris

Reply via email to