IIS sends login dialog for already authenticated users.

Discussion in 'ASP .Net Security' started by Sandy, Jan 7, 2005.

  1. Sandy

    Sandy Guest

    Hi,
    I am using ASP.NET windows authentication in one of the applications. My
    application is deployed on one of the 2003 servers. This server is member of
    a domain say "MyDomain".
    Now, when a user who is logged on to a system which dos not belongs to
    "MyDomain", tries to access this site, he gets a login dialog box which is
    correct. However, if the user is logged on to a system that belongs to
    "MyDomain", he should not get this dialog box. but in my case, he also gets
    this box.

    The same code works well in windows 2000.

    Please suggest.
     
    Sandy, Jan 7, 2005
    #1
    1. Advertising

  2. Sandy

    Ken Schaefer Guest

    This is a browser issue - it is the browser the decides whether to prompt
    the user for credentials. Check the rquirements for "auto logon" here:

    http://support.microsoft.com/?id=258063
    Internet Explorer May Prompt You for a Password

    Cheers
    Ken

    "Sandy" <> wrote in message
    news:...
    > Hi,
    > I am using ASP.NET windows authentication in one of the applications. My
    > application is deployed on one of the 2003 servers. This server is member
    > of
    > a domain say "MyDomain".
    > Now, when a user who is logged on to a system which dos not belongs to
    > "MyDomain", tries to access this site, he gets a login dialog box which
    > is
    > correct. However, if the user is logged on to a system that belongs to
    > "MyDomain", he should not get this dialog box. but in my case, he also
    > gets
    > this box.
    >
    > The same code works well in windows 2000.
    >
    > Please suggest.
    >
     
    Ken Schaefer, Jan 7, 2005
    #2
    1. Advertising

  3. Sandy

    Sandy Guest

    I checked this Ken.
    This is not the case. IE is configured correctly.
    The issues seems to happen only on windows 2003 servers with win XP clients.

    "Ken Schaefer" wrote:

    > This is a browser issue - it is the browser the decides whether to prompt
    > the user for credentials. Check the rquirements for "auto logon" here:
    >
    > http://support.microsoft.com/?id=258063
    > Internet Explorer May Prompt You for a Password
    >
    > Cheers
    > Ken
    >
    > "Sandy" <> wrote in message
    > news:...
    > > Hi,
    > > I am using ASP.NET windows authentication in one of the applications. My
    > > application is deployed on one of the 2003 servers. This server is member
    > > of
    > > a domain say "MyDomain".
    > > Now, when a user who is logged on to a system which dos not belongs to
    > > "MyDomain", tries to access this site, he gets a login dialog box which
    > > is
    > > correct. However, if the user is logged on to a system that belongs to
    > > "MyDomain", he should not get this dialog box. but in my case, he also
    > > gets
    > > this box.
    > >
    > > The same code works well in windows 2000.
    > >
    > > Please suggest.
    > >

    >
    >
    >
     
    Sandy, Jan 7, 2005
    #3
  4. Have the Servers been "hardened" or had some security scripts run over them
    to lock them down in any way?

    --

    - Paul Glavich
    ASP.NET MVP
    ASPInsider (www.aspinsiders.com)


    "Sandy" <> wrote in message
    news:...
    > I checked this Ken.
    > This is not the case. IE is configured correctly.
    > The issues seems to happen only on windows 2003 servers with win XP

    clients.
    >
    > "Ken Schaefer" wrote:
    >
    > > This is a browser issue - it is the browser the decides whether to

    prompt
    > > the user for credentials. Check the rquirements for "auto logon" here:
    > >
    > > http://support.microsoft.com/?id=258063
    > > Internet Explorer May Prompt You for a Password
    > >
    > > Cheers
    > > Ken
    > >
    > > "Sandy" <> wrote in message
    > > news:...
    > > > Hi,
    > > > I am using ASP.NET windows authentication in one of the applications.

    My
    > > > application is deployed on one of the 2003 servers. This server is

    member
    > > > of
    > > > a domain say "MyDomain".
    > > > Now, when a user who is logged on to a system which dos not belongs to
    > > > "MyDomain", tries to access this site, he gets a login dialog box

    which
    > > > is
    > > > correct. However, if the user is logged on to a system that belongs to
    > > > "MyDomain", he should not get this dialog box. but in my case, he also
    > > > gets
    > > > this box.
    > > >
    > > > The same code works well in windows 2000.
    > > >
    > > > Please suggest.
    > > >

    > >
    > >
    > >
     
    Paul Glavich [MVP ASP.NET], Jan 7, 2005
    #4
  5. On our servers, we had to alter the setting mentioned in this article (
    http://www.microsoft.com/resources/...dowsServ/2003/all/deployguide/en-us/28433.asp )
    and set it back to its default setting as all client requests were failing,
    although in our case, I think it was Win2000 that was always failing. Same
    symptoms though.

    --

    - Paul Glavich
    ASP.NET MVP
    ASPInsider (www.aspinsiders.com)


    "Sandy" <> wrote in message
    news:...
    > I checked this Ken.
    > This is not the case. IE is configured correctly.
    > The issues seems to happen only on windows 2003 servers with win XP

    clients.
    >
    > "Ken Schaefer" wrote:
    >
    > > This is a browser issue - it is the browser the decides whether to

    prompt
    > > the user for credentials. Check the rquirements for "auto logon" here:
    > >
    > > http://support.microsoft.com/?id=258063
    > > Internet Explorer May Prompt You for a Password
    > >
    > > Cheers
    > > Ken
    > >
    > > "Sandy" <> wrote in message
    > > news:...
    > > > Hi,
    > > > I am using ASP.NET windows authentication in one of the applications.

    My
    > > > application is deployed on one of the 2003 servers. This server is

    member
    > > > of
    > > > a domain say "MyDomain".
    > > > Now, when a user who is logged on to a system which dos not belongs to
    > > > "MyDomain", tries to access this site, he gets a login dialog box

    which
    > > > is
    > > > correct. However, if the user is logged on to a system that belongs to
    > > > "MyDomain", he should not get this dialog box. but in my case, he also
    > > > gets
    > > > this box.
    > > >
    > > > The same code works well in windows 2000.
    > > >
    > > > Please suggest.
    > > >

    > >
    > >
    > >
     
    Paul Glavich [MVP ASP.NET], Jan 7, 2005
    #5
  6. Sandy

    Sandy Guest

    Yes. Some scripts does run but not sure what exactly they are. Its a
    production server.

    "Paul Glavich [MVP ASP.NET]" wrote:

    > Have the Servers been "hardened" or had some security scripts run over them
    > to lock them down in any way?
    >
    > --
    >
    > - Paul Glavich
    > ASP.NET MVP
    > ASPInsider (www.aspinsiders.com)
    >
    >
    > "Sandy" <> wrote in message
    > news:...
    > > I checked this Ken.
    > > This is not the case. IE is configured correctly.
    > > The issues seems to happen only on windows 2003 servers with win XP

    > clients.
    > >
    > > "Ken Schaefer" wrote:
    > >
    > > > This is a browser issue - it is the browser the decides whether to

    > prompt
    > > > the user for credentials. Check the rquirements for "auto logon" here:
    > > >
    > > > http://support.microsoft.com/?id=258063
    > > > Internet Explorer May Prompt You for a Password
    > > >
    > > > Cheers
    > > > Ken
    > > >
    > > > "Sandy" <> wrote in message
    > > > news:...
    > > > > Hi,
    > > > > I am using ASP.NET windows authentication in one of the applications.

    > My
    > > > > application is deployed on one of the 2003 servers. This server is

    > member
    > > > > of
    > > > > a domain say "MyDomain".
    > > > > Now, when a user who is logged on to a system which dos not belongs to
    > > > > "MyDomain", tries to access this site, he gets a login dialog box

    > which
    > > > > is
    > > > > correct. However, if the user is logged on to a system that belongs to
    > > > > "MyDomain", he should not get this dialog box. but in my case, he also
    > > > > gets
    > > > > this box.
    > > > >
    > > > > The same code works well in windows 2000.
    > > > >
    > > > > Please suggest.
    > > > >
    > > >
    > > >
    > > >

    >
    >
    >
     
    Sandy, Jan 14, 2005
    #6
  7. Sandy

    Sandy Guest

    Paul, Thanks a lot.

    Are you saying that in your case, clients were windows 2000 and Server was
    windows 2003?


    "Paul Glavich [MVP ASP.NET]" wrote:

    > On our servers, we had to alter the setting mentioned in this article (
    > http://www.microsoft.com/resources/...dowsServ/2003/all/deployguide/en-us/28433.asp )
    > and set it back to its default setting as all client requests were failing,
    > although in our case, I think it was Win2000 that was always failing. Same
    > symptoms though.
    >
    > --
    >
    > - Paul Glavich
    > ASP.NET MVP
    > ASPInsider (www.aspinsiders.com)
    >
    >
    > "Sandy" <> wrote in message
    > news:...
    > > I checked this Ken.
    > > This is not the case. IE is configured correctly.
    > > The issues seems to happen only on windows 2003 servers with win XP

    > clients.
    > >
    > > "Ken Schaefer" wrote:
    > >
    > > > This is a browser issue - it is the browser the decides whether to

    > prompt
    > > > the user for credentials. Check the rquirements for "auto logon" here:
    > > >
    > > > http://support.microsoft.com/?id=258063
    > > > Internet Explorer May Prompt You for a Password
    > > >
    > > > Cheers
    > > > Ken
    > > >
    > > > "Sandy" <> wrote in message
    > > > news:...
    > > > > Hi,
    > > > > I am using ASP.NET windows authentication in one of the applications.

    > My
    > > > > application is deployed on one of the 2003 servers. This server is

    > member
    > > > > of
    > > > > a domain say "MyDomain".
    > > > > Now, when a user who is logged on to a system which dos not belongs to
    > > > > "MyDomain", tries to access this site, he gets a login dialog box

    > which
    > > > > is
    > > > > correct. However, if the user is logged on to a system that belongs to
    > > > > "MyDomain", he should not get this dialog box. but in my case, he also
    > > > > gets
    > > > > this box.
    > > > >
    > > > > The same code works well in windows 2000.
    > > > >
    > > > > Please suggest.
    > > > >
    > > >
    > > >
    > > >

    >
    >
    >
     
    Sandy, Jan 14, 2005
    #7
  8. Yes. Not all clients were Win2000, but only these ones had the problems. Our
    server group had performed "hardening" on the servers, and configured that
    specific setting to only accept the highest levels of encryption and
    authentication. The new XP builds that had also been performed had a similar
    hardening process and were configured appropriately. The older builds of
    Windows2000 were not configured to support the extra security settings and
    were failing. Once I set the Windows2003 servers back to the default
    settings (as listed on that article link I posted) it all worked fine.


    --

    - Paul Glavich
    ASP.NET MVP
    ASPInsider (www.aspinsiders.com)


    "Sandy" <> wrote in message
    news:...
    > Paul, Thanks a lot.
    >
    > Are you saying that in your case, clients were windows 2000 and Server was
    > windows 2003?
    >
    >
    > "Paul Glavich [MVP ASP.NET]" wrote:
    >
    > > On our servers, we had to alter the setting mentioned in this article (
    > >

    http://www.microsoft.com/resources/...dowsServ/2003/all/deployguide/en-us/28433.asp )
    > > and set it back to its default setting as all client requests were

    failing,
    > > although in our case, I think it was Win2000 that was always failing.

    Same
    > > symptoms though.
    > >
    > > --
    > >
    > > - Paul Glavich
    > > ASP.NET MVP
    > > ASPInsider (www.aspinsiders.com)
    > >
    > >
    > > "Sandy" <> wrote in message
    > > news:...
    > > > I checked this Ken.
    > > > This is not the case. IE is configured correctly.
    > > > The issues seems to happen only on windows 2003 servers with win XP

    > > clients.
    > > >
    > > > "Ken Schaefer" wrote:
    > > >
    > > > > This is a browser issue - it is the browser the decides whether to

    > > prompt
    > > > > the user for credentials. Check the rquirements for "auto logon"

    here:
    > > > >
    > > > > http://support.microsoft.com/?id=258063
    > > > > Internet Explorer May Prompt You for a Password
    > > > >
    > > > > Cheers
    > > > > Ken
    > > > >
    > > > > "Sandy" <> wrote in message
    > > > > news:...
    > > > > > Hi,
    > > > > > I am using ASP.NET windows authentication in one of the

    applications.
    > > My
    > > > > > application is deployed on one of the 2003 servers. This server is

    > > member
    > > > > > of
    > > > > > a domain say "MyDomain".
    > > > > > Now, when a user who is logged on to a system which dos not

    belongs to
    > > > > > "MyDomain", tries to access this site, he gets a login dialog box

    > > which
    > > > > > is
    > > > > > correct. However, if the user is logged on to a system that

    belongs to
    > > > > > "MyDomain", he should not get this dialog box. but in my case, he

    also
    > > > > > gets
    > > > > > this box.
    > > > > >
    > > > > > The same code works well in windows 2000.
    > > > > >
    > > > > > Please suggest.
    > > > > >
    > > > >
    > > > >
    > > > >

    > >
    > >
    > >
     
    Paul Glavich [MVP ASP.NET], Jan 15, 2005
    #8
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. SamIAm
    Replies:
    1
    Views:
    466
    Ed Gibbs
    Dec 4, 2003
  2. Keithb
    Replies:
    0
    Views:
    483
    Keithb
    Oct 28, 2006
  3. BGU

    IIS sends empty .CSS file

    BGU, Jul 13, 2007, in forum: ASP .Net
    Replies:
    1
    Views:
    1,717
  4. Jim
    Replies:
    2
    Views:
    137
  5. Abhijit
    Replies:
    0
    Views:
    153
    Abhijit
    Apr 12, 2004
Loading...

Share This Page