Integrated Windows Authentication problem

[Jimmy J.]

I have a website, that works perfectly locally - it works perfectly, setting
it up on the Development server, but then, when we set itup on the
Production server (all using same SQL Server), when accessing the site
(another intranet server), it prompts for username and password,
Windows-style, which is not what we want -

IWA is checked (alone) in IIS, In the Web.Config file, Impersonate is set
to true, and Authentication Mode is set to Windows.

I'm assuming IIS is setup differently on the Production server, but the guy
who does that isn't sure what that might be.

Is there something in IIS I need to change/add, other than checking IWA, to
make this work like the other servers/computers?

 

[Guest]

I have a website, that works perfectly locally - it works perfectly, setting
it up on the Development server, but then, when we set itup on the
Production server (all using same SQL Server), when accessing the site
(another intranet server), it prompts for username and password,
Windows-style, which is not what we want -

IWA is checked (alone) in IIS, In the Web.Config file, Impersonate is set
to true, and Authentication Mode is set to Windows.

Do you really need Impersonate=true?

It looks like your account doesn't have rights to access server (and
it works locally only)

----------------------------------
Set the NTFS access control list (ACL) for the xxx-directory to allow
access to only those identities that are in the xxx-group and any
required system accounts. You would need to be sure to include the
identity of the ASP.NET process. The identity of the ASP.NET process
for Windows 2000 Server or Windows NT is the local ASPNET account. The
identity of the ASP.NET process for Windows Server 2003 and later is
the identity of the IIS application pool, which by default is the
NETWORK SERVICE account.

source: http://msdn2.microsoft.com/en-us/library/134ec8tc.aspx

 

[bruce barker]

your iis box is probably setup with kerberos so credential delegation
will work. this forces the dialog. if you can turn off impersonate (or
host sqlserver on the iis box), then you can switch to ntlm like on your
dev box.

-- bruce (sqlwork.com)