iis security: IIS continually prompting users for their password -- iis security

Re: IIS continually prompting users for their password

David Wang [Msft]
9/30/2005 7:25:15 PM

Sounds like you have anonymous authentication enabled for those URLs, and
the anonyomus user credential configured in IIS is invalid.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
I have a problem displaying some of the pages on our web server. The server
is a Windows 2003 server (IIS 6.0) that has two web sites separated by host
headers. The setup is really simple, with a mix of asp and static HTML
pages.
I haven't really done anything fancy configuration-wise. We secure some of
our online learning resources via Basic Authentication (No SSL as yet I'm
afraid) and NTFS permissions. The user clicks on a link to a resource and is
prompted for their username and password, this is accepted and they are
shown
a menu of resources to choose. They click on one of the links and a login
box
appears again. This login box will not accept any username or password but
if
you press Cancel it displays the resource anyway. I've checked all the NTFS
permissions up and down the folder structure and everything carries through
correctly. I've also checked the IIS logs, but they do not throw up
anything.
The only thing I can think the problem can be is to do with the way IIS
handles security of .js files as the resources use this within the HTML? Can
anyone help me try to troubleshoot this? I would be forever grateful.
Thanks in advance.

Stephen

Re: IIS continually prompting users for their password

Stephen Ellis
10/3/2005 4:55:03 AM

Hi David

Thanks for responding. I set Basic Authentication at the Virtual Directory
level and it appears that this setting is carried down for all urls off of
the VD. Is this what you meant?

Thanks again

Stephen

[quoted text, click to view]

Re: IIS continually prompting users for their password

David Wang [Msft]
10/3/2005 5:41:55 PM

[quoted text, click to view]

It sounds like Basic Authentication was enforced for the URL that the user
first clicks

[quoted text, click to view]

This sounds like the URL of the menus have other authentication enabled
because if it was just Basic, then it should just display (browser should be
configured to auto-authenticate using Basic and this should just
automatically work). If it displays when you hit cancel, it probably means
that anonymous authentication is enabled but anonymous user is
misconfigured -- so the web browser keeps trying anonymous failing -- but
when you hit cancel, the browser auto-authenticates using your user identity
and that works, so it succeeds.

The continuous prompting simply says that something is misconfigured on your
server and has nothing to do with the resource type.

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Hi David

Thanks for responding. I set Basic Authentication at the Virtual Directory
level and it appears that this setting is carried down for all urls off of
the VD. Is this what you meant?

Thanks again

Stephen

[quoted text, click to view]

Re: IIS continually prompting users for their password

Stephen Ellis
10/4/2005 4:27:03 AM

Hi David

Thanks for all your help. I rebuilt the website from scratch within IIS
(took me about 30 mins) and everything seems to be working fine now. Thanks
for giving me the pointers it's really appreciated.

Stephen

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the iis security group.