# HAProxy NTLM + Reporting services

**URL:** <https://discourse.haproxy.org/t/haproxy-ntlm-reporting-services/8348>\
**Category:** Help!\
**Created:** [January 30, 2023, 1:56pm UTC](https://discourse.haproxy.org/t/haproxy-ntlm-reporting-services/8348 "2023-01-30T13:56:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kalwas](https://avatars.discourse-cdn.com/v4/letter/k/e68b1a/32.png) [@Kalwas](https://discourse.haproxy.org/u/Kalwas)\
**Post date:** [January 30, 2023, 1:56pm UTC](https://discourse.haproxy.org/t/haproxy-ntlm-reporting-services/8348/1 "2023-01-30T13:56:19Z")

</div>

Hello

I created a HaProxy configuration that terminates SSL and routes to the Reporting Services server.  
Unfortunately, there is a problem with NTLM, which causes that every request does not authorize the user, causing the report viewer to not find the bound url and after refreshing the page it loads correctly.

I tried several different options and updated HAProxy to version 2.7.2-1ppa1~focal 2023/01/20

`

> global  
> log /dev/log local0  
> log /dev/log local1 notice  
> chroot /var/lib/haproxy  
> stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners  
> stats timeout 30s  
> user haproxy  
> group haproxy  
> daemon  
> #logs only errors  
> option dontlog-normal  
> # log healt issues  
> option log-health-checks  
> ca-base /etc/ssl/certs  
> crt-base /etc/ssl/private  
> ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384  
> ssl-default-bind-ciphersuites TLS\_AES\_128\_GCM\_SHA256:TLS\_AES\_256\_GCM\_SHA384:TLS\_CHACHA20\_POLY1305\_SHA256  
> ssl-default-bind-options ssl-min-ver TLSv1.2  
> tune.ssl.default-dh-param 2048
> 
> defaults  
> log global  
> mode http  
> option httplog  
> option dontlognull  
> timeout connect 5000  
> timeout client 50000  
> timeout server 50000  
> errorfile 400 /etc/haproxy/errors/400.http  
> errorfile 403 /etc/haproxy/errors/403.http  
> errorfile 408 /etc/haproxy/errors/408.http  
> errorfile 500 /etc/haproxy/errors/500.http  
> errorfile 502 /etc/haproxy/errors/502.http  
> errorfile 503 /etc/haproxy/errors/503.http  
> errorfile 504 /etc/haproxy/errors/504.http
> 
> frontend raporty  
> bind 192.16.0.10:80  
> bind 192.16.0.10:443 ssl crt /etc/ssl/certs/haproxy.pem  
> option http-keep-alive  
> default\_backend reportserver  
> option forwardfor
> 
> backend reportserver  
> mode http  
> balance roundrobin  
> option http-keep-alive  
> option httpchk uri /reports  
> http-check expect status 401  
> server sql01 192.16.0.11:80 check  
> server sql02 192.16.0.12:80 check

’