Integrated Authentication with SSL

[vic]

Hi,
I’ve got an ASP.NET 2.0 web application that requires SSL. In addition, the pages are configured to use Integrated Windows Authentication. I am having a problem getting automatic authentication to work for internal network users. If they try to access the page using an internal server name in the Url, the authentication takes place automatically but they must first deal with a warning page (in IE7) that alerts them to a problem with the site’s security certificate since the names don’t match up. However, if they access the page using the fully-qualified domain they get a dialog box asking them to authenticate. I thought if I added the fully-qualified secure domain name (https://mydomain.com) to the exception list (in IE7’s settings) for bypassing the proxy server the security credentials would carry through. But it’s not happening. How can I get integrated authentication to work while still using SSL?

Thanks for your help.

 

[Joe Kaplan]

Does the machine account have a servicePrincipalName registered in AD for
the fully qualified domain name? Something like HOST/mydomain.com or
HTTP/mydomain.com should work. That should get Kerberos authentication
working properly.

Joe K.

 

[Dominick Baier]

You also have to add the fqdn to the "Intranet" zone list in IE - otherwise
the credentials won't be sent automatically.

....or change the SSL Certificate to use the hostname only (if you only access
the machine internally)

 

[vic]

Joe,
Thanks for your feedback.
Will check with my network guy.

 

[Joe Kaplan]

Domick's suggestion may be the only problem as well. I always forget about
the fact that fully qualified domain names aren't in the intranet zone by
default and thus won't automatically do integrated auth with the default IE
policy. The whole Kerb thing may be misleading or not important. Still, it
is always good to have your SPN ducks in a row.

Joe K.

 

[vic]

Joe,
Wondering if you could provide some more information or direct me to a good reference on how to go about what you suggested.

I appreciate your help.

 

[Dominick Baier]

http://msdn.microsoft.com/msdnmag/issues/05/09/SecurityBriefs/default.aspx