Work was to set our TFS (SSL-enabled on the box) to use Basic Authentication. We tried your second suggestion, but unfortunately my client's current means of publishing web applications (Juniper Reverse Proxy) is having issues with Windows Authentication and/or IIS7 (it is a very old Juniper device). It appears to me that WSAM may enable making requests to '' without knowledge of the This mechanism works for the client web browser, but of course not for Team Explorer.įurther searching since posting my question yielded few results, but this is looking promising: Juniper's WSAM - Windows Secure Application Manager. with a querystring indicating the target server is. Then to access the portal would require authentication and provide a link to the published web site. As it turns out, the URL of the Juniper device is not merelyĪ host name, so the client's view of the URLs are not equivalent to what the web server actually exposes (it is not a transparent reverse proxy, nor merely a firewall publishing rule).įor example, the Juniper 'SSL VPN' portal could be Unfortunately the term 'SSL VPN' is misleading, apologies: the Juniper 'SSL VPN' device is a web portal which accepts incoming HTTP requests and passes them to the web servers being published. Ryan Hanisco MCSE, MCTS:SQL 2005, Project+ Then internally, have the servers be completely SSL-unaware so that only the Juniper is handling decrypts. The best solution here is to always use FQDN and force even your internalĬlients to hairpin through the SSL device. The difficulty here comes in the assumption that the internal clients needn't be encrypted, but that the external ones do. To the outside (Application, SSRS, SharePoint, Web Services). In that case, you'll need to plan carefully which tiers you want to expose If you are opening access to the TFS servers through the Juniper having it do the SSL decrypts rather than passing this all the way to the servers, that is a different animal. If you are creating an SSL-based VPN tunnel between the client and the Juniper, you should be able to have pretty much everything working as though you were locally connected, though you'll want to make sure you are passing DNS resolution through the tunnelĪnd that you are using FQDN as the server names wherever possible.

so clarify if I am missing the mark here. I am not sure I fully understand your question as there are two ways to interpret that.

Ssl vpn juniper