# NTLM issue after jonin domain for HAProxy

**URL:** <https://discourse.haproxy.org/t/ntlm-issue-after-jonin-domain-for-haproxy/9060>\
**Category:** Help!\
**Created:** [September 22, 2023, 9:34am UTC](https://discourse.haproxy.org/t/ntlm-issue-after-jonin-domain-for-haproxy/9060 "2023-09-22T09:34:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dungca121](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/dungca121/32/2044_2.png) [@dungca121](https://discourse.haproxy.org/u/dungca121)\
**Post date:** [September 22, 2023, 9:34am UTC](https://discourse.haproxy.org/t/ntlm-issue-after-jonin-domain-for-haproxy/9060/1 "2023-09-22T09:34:31Z")

</div>

My website uses the Window Account to authenticate.  
After I joined HAProxy to AD, The browser: Microsoft Edge always asked for credentials even though I input the correct username and password.

HAProxy version: 2.6  
SSSD version 1.8

Do you guys have any idea?

---

<div class="post-metadata">

**Author:** ![Markus](https://avatars.discourse-cdn.com/v4/letter/m/b782af/32.png) [@Markus](https://discourse.haproxy.org/u/Markus)\
**Post date:** [September 22, 2023, 12:18pm UTC](https://discourse.haproxy.org/t/ntlm-issue-after-jonin-domain-for-haproxy/9060/2 "2023-09-22T12:18:06Z")

</div>

in Edge or via GPO you can define when the Browser will use Auth via NTLM (Windows integragted). There are a few rules, which IE or Edge will use to detect, whether its “intranet” or “everything else”.  
eg. signle domain names like will use ntlm, any domain like [my.server.com](http://my.server.com) will use basic auth or the creditential popup.

you have to set **http-keep-alive** and **prefer-last-server** on backend and **http-keep-alive** on frontend

---

<div class="post-metadata">

**Author:** ![dungca121](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/dungca121/32/2044_2.png) [@dungca121](https://discourse.haproxy.org/u/dungca121)\
**Post date:** [September 25, 2023, 9:14am UTC](https://discourse.haproxy.org/t/ntlm-issue-after-jonin-domain-for-haproxy/9060/3 "2023-09-25T09:14:30Z")

</div>

Thanks Markus

I recognize that issue with DNS loop. HAProxy set the nameserver to the AD and AD had the record point to HAProxy.