Integrated Windows Authentication

We are facing some really weird issues with integrated Windows authentication with IIS, and I'm not sure if I can see the template or not.

We have a DNS-Cname entry called Fred. We have an IIS website with Fred set as the host header. When I connect to this site, I receive a request with an account. I would expect my credentials to be passed. If I enter my credentials, I will be granted access.

Then I create a local host entry called Betty and point the host file to the same IP address as Fred and change the host header to Betty. There is no CName entry anywhere. When I contact Betty, I automatically authenticate, and everything is in order.

If I try to bypass the CName entry and create an entry in the local Fred host file and change the host header to Fred. I am still receiving an authentication request.

As I see, he has two questions. How does this CName entry affect resolution here or is it a red herring. Secondly, what happens to this challenge? We have similar symptoms elsewhere, and we are worried that our authentication token is getting confused somewhere. Can anyone complete the order using authentication, i.e. which packets are sent to which machines. Is there any way to trace this? (I think WireShark or something similar). How can I prove that my authentication token is passable and valid?

+6
authentication iis dns active-directory
source share
2 answers

The reason for the authentication window is simple: Internet Explorer sends your credentials only if it believes that the host is in the Local Intranet zone (assumed to be the default). If the host outside of what IE considers β€œlocal” is requesting NTLM credentials, an authentication window will appear and you must authenticate manually.

If you want your credentials to be sent automatically, make sure IE thinks about it in the "Local Intranet". Check the zone information far to the right in the status bar to see the current active zone.

IE takes into account a lot of things to decide whether to consider a host as a "local intranet":

  • is the IP address on the local subnet β†’ YES
  • this is a simple host name (ie "no dots") -> YES
  • in IE settings: is it in the "Sites ..." list for "Local Intranet" β†’ YES
  • in IE options: is it in the proxy exception list β†’ YES
  • is the UNC path -> YES
  • otherwise: NO
  • Sometimes in the list of personal passwords for this host name there is an old password (accessible through the Control Panel β†’ User Accounts). If this is not the case, similar problems may occur.

My suspicion is that your host "fred" does not fulfill condition number 2 to number 4, but your test case "Betty" somehow does.

How the name was resolved (CName record, record, hosts file, etc.) does not matter, because the name resolution method is not transparent to the calling application. IE just asks for the name "XYZ" and returns the IP address.

However, recent configuration changes may require you to clear the local DNS cache. Random ipconfig /flushdns may help ipconfig /flushdns , alternatively you can temporarily stop the DNS client service.

The described internal logic is applied to the host name and security settings changes depending on the result.

+6
source share

CName is a red herring. Does not affect Windows Auth or not. The easiest way to trace it is with a violinist. You should see your request, followed by a 401 response (it contains the authentication that the server supports), then your request is sent again with authentication data (or you are prompted, and then sent).

0
source share

All Articles