iis security: Integrated Windows Authentication - Does not work on Virtual websites -- iis security

Re: Integrated Windows Authentication - Does not work on Virtual websites

John
4/21/2004 7:25:38 AM

Ken,

Thanks for your response. The answers are as below.

1.Anonymous Authentication is not Enabled.
2.I am trying to test this site from the Intranet. But,
even trying it externally it does not work either in
Windows NT 4.0 IIS 4.0 or Win2K and IIS 5.0.

This site is not in the default website, but another site
has been created which is a virtual site in IIS.

This has not been working in IIS 4.0 nor in IIS 5.0.

[quoted text, click to view]

Re: Integrated Windows Authentication - Does not work on Virtual websites

clnorman
4/21/2004 8:46:02 AM

Re: Integrated Windows Authentication - Does not work on Virtual websites

John
4/21/2004 11:10:57 AM

The folder resides in the same webserver.

OK let me make it more clear

There is a Default Website created by IIS where most of
our contents are there.

I have another website say the name is LOCATION in the
same webserver. And under this there is a folder that
needs to be password protected. So, this is the one which
is not working.

[quoted text, click to view]
the best way to set up departmental web folders on our
Intranet. My development/testing computer is Windows
2000 with IIS5. We have a Windows 2000 domain with
Active Directory. My application server is ColdFusion 5,
but I will just address my IIS findings. When I set up
Integrated Windows Authentication on a folder in IIS (both
anonymous and basic turned off), IIS does pick up the
user's domain id (this is authentication). When I create
a virtual directory to a folder that is physically on the
web server, the domain authorization to this folder works
(logged in users without permission to the folder are
rejected). However, when I defined a virtual directory
to a folder that is NOT on the web server, IIS asks for a
name and password to use when getting the folder. It
appears to me that this named user (not the logged on
user) is the one that determines whether authorization to
the folder is accepted or rejected. In my testing, if
the folder's physical location is NOT on the web server
and the user named when setting up the virtual directory
is authorized for the physical folder, then the logged on
user is passed on into the web pages, even if he/she is
not authorized for the folder. In other words, NTLM
authorization of the logged on user for folders only
worked for me when the folder physically resided on the
web server. I hopes this helps.
[quoted text, click to view]

Re: Integrated Windows Authentication - Does not work on Virtual websites

John
4/21/2004 11:15:49 AM

Hi thanks for your answer........well, there is no
IUSER_Machinename in this directory which has been given
permission.

I do not even given EVERYONE permission on this folder. I
have only one user who has permission for this folder
which when they access this site, it should pop up and
they should enter this userid and password to access it.
[quoted text, click to view]

Re: Integrated Windows Authentication - Does not work on Virtual websites

Bojidar Alexandrov
4/21/2004 5:46:44 PM

This is very doubtful.
Also remove rights of guests/IUser_Mashinename from this directory through
NTFS permisions.

Re: Integrated Windows Authentication - Does not work on Virtual websites

Ken Schaefer
4/22/2004 12:10:36 AM

a) Is anonymous authentication enabled? If so, disable it.

b) Are you using Internet Explorer? If so, it may be automatically logging
you in, if the site is in the local Intranet security zone. see:
http://support.microsoft.com/?id=258063

Cheers
Ken

[quoted text, click to view]
: Hi,
:
: Please, kindly let me know that there has been no answer
: for my posting for a long time. I have another site
: created in the webserver [Win2k and IIS 5.0]. A folder
: within this site needs to be password protected and it
: should use Windows Authentication. I have disabled Basic
: Authentication and have only enabled Integrated Windows
: Authentication. But, it does not authenticate and it goes
: in straight to the website. Is this a security flaw in IIS
: 4.0 and IIS 5.0?
:
: Please is there anyone with IIS expertise. Let me know
: What could be wrong?

Re: Integrated Windows Authentication - Does not work on Virtual websites

Ken Schaefer
4/22/2004 12:17:57 PM

Hi John,

In IIS 4.0 and IIS 5.0, can you ensure that logging for the website in
question is W3C Extended, then choose to log all the properties for each
request (in particular the cs-user etc).

Then perform some requests for files in that directory, and post the
relevant lines from the logfile to the group? I'd like to see if IIS think
that the browser is sending some credentials.

If worst comes to worst, we can install Ethereal (www.ethereal.com) on your
client machines, and do a network capture of the traffic passing back and
forward between IIS and your browser, and then I can tell you what auth
mechanisms IIS is using, and what the browser is doing in response.

Cheers
Ken

[quoted text, click to view]
: Ken,
:
: Thanks for your response. The answers are as below.
:
: 1.Anonymous Authentication is not Enabled.
: 2.I am trying to test this site from the Intranet. But,
: even trying it externally it does not work either in
: Windows NT 4.0 IIS 4.0 or Win2K and IIS 5.0.
:
: This site is not in the default website, but another site
: has been created which is a virtual site in IIS.
:
: This has not been working in IIS 4.0 nor in IIS 5.0.
:
: >-----Original Message-----
: >a) Is anonymous authentication enabled? If so, disable it.
: >
: >b) Are you using Internet Explorer? If so, it may be
: automatically logging
: >you in, if the site is in the local Intranet security
: zone. see:
: > http://support.microsoft.com/?id=258063
: >
: >Cheers
: >Ken
: >
: >"John" <anonymous@discussions.microsoft.com> wrote in
: message
: >news:226301c427a8$a8b6fc90$a101280a@phx.gbl...
: >: Hi,
: >:
: >: Please, kindly let me know that there has been no answer
: >: for my posting for a long time. I have another site
: >: created in the webserver [Win2k and IIS 5.0]. A folder
: >: within this site needs to be password protected and it
: >: should use Windows Authentication. I have disabled Basic
: >: Authentication and have only enabled Integrated Windows
: >: Authentication. But, it does not authenticate and it
: goes
: >: in straight to the website. Is this a security flaw in
: IIS
: >: 4.0 and IIS 5.0?
: >:
: >: Please is there anyone with IIS expertise. Let me know
: >: What could be wrong?
: >
: >
: >.
: >

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the iis security group.