Table of Contents

iPhone/iPad Authentication Issues

When using Apple devices like iPhone or iPad to access the Ometa Framework, users might encounter issues when trying to authenticate using the standard Windows authentication flow (NTLM).

Explanation

The default Windows authentication flow in Ometa uses NTLM. However, many mobile devices, specifically iPhone and iPad, often have trouble handling NTLM authentication prompts or fail to pass credentials correctly after being prompted. This results in users being unable to log in to the environment.

Solution

To resolve this, a specific Windows Form Login can be enabled. This provides a web-based form where users can manually enter their Windows credentials, bypassing the standard NTLM handshake that causes issues on Apple devices.

Enable Windows Form Logins

This is an opt-in feature. To enable this form, you need to add or update a setting in the Config table.

  1. Open your database management tool (e.g., SQL Server Management Studio).
  2. Locate the Config table in the Ometa database.
  3. Locate or add the setting Allow Windows Form Logins.
  4. Set the value to True.

If this entry is not present or is set to any other value than 'True', the form will not be active, and the system will default to the standard Windows authentication.

Besides this configuration, a regex check is also made against the User-Agent header of the request. The built-in regex for this check is iPhone|iPad|(?=.*Macintosh)(?=.*Mobile) meaning that if the User-Agent detects iPhone, iPad or Macintosh + Mobile in that header, the check is successful.

You can customize this regex by adding or updating the Windows Form Login Regex value in the Config table.

The Windows Form login is only offered when both conditions are met:

  • the Allow Windows Form Logins setting is set to True
  • the User-Agent header is successfully checked against the configured (or default) regex
Note

The above settings are cached. After changing them, it can take up to 10 minutes before the changes are picked up. If you want to force the change immediately, you can restart the web server (IIS).

Important

The Windows Form Login is slightly less secure than the normal Windows (NTLM) authentication flow as it transmits credentials via a web form (although still encrypted). This feature should only be enabled when there are users with iPhone or iPad who are unable to log in via the standard NTLM prompt.

Another and safer alternative in this case is to use Microsoft Authentication instead of Windows Authentication. This will allow users to authenticate using the standard OpenID Connect flow of Microsoft, which is fully supported on all devices and platforms.