If you are just interested in getting rid of the login prompt then you
are probably overlooking the system's misconfigurations and simply
trying to get something to work insecurely. If that is the objective,
then use anonymous authentication (i.e. no security).

The relevent security-related questions are:
1. Why should the client automatically broadcast current computer login
credentials to any server. Suppose that server is rogue -- the client
just compromised your user credentials by giving it to the server
2. Why should the server automatically trust credentials given by the
client - who should the server validate against?

If you are getting a login prompt, then it simply means you have not
configured the client/server correctly enough to feel that the
transaction is trusted.

Remember, just because you think the action is trusted does not mean
the computer agrees. Humans are remarkably bad at enforcing security
protocol and good at making leaps of faith; computers are remarkably
bad at determining trust but good at enforcing security protocol.

[quoted text, click to view]

Not the right way to reason about security or auto-login.

When you configure the server to require authentication, it will prompt
for authentication ALL the time. The question is whether the client
automatically responds with user credentials that meet the server's
demands.

The fact that the intranet site is in the same domain as the username
and computer is irrelevant from a security perspective. All the server
knows is that a client is asking for a secured document, and the server
knows a domain controller to validate user credentials. So, the server
says to the client "halt, prove to me who you are and I will authorize
and give you the document". At which point the client has to provide
some credentials (which may be from the same domain as the server --
irrelevant), and the server takes those credentials and asks the domain
controller if it is valid. If valid, the server returns the document.
If invalid, the server continues saying "halt, prove to me who you are
and I will give you the document".

No where in the entire security protocol does "domain" matter. The
concept of "domain" is only a human organizational concept useful for
authorization (i.e. who can do what). It has no relevance for
authentication (i.e. who you are).

[quoted text, click to view]

Of course, depending on the authentication protocol, the transmission
of the user credentials and protocol sequenc differs, and some
protocols are not safe to automatically send user credentials (such as
Basic authentication).

The systems are secure the way they are. If you want to optimize away
the user login prompts, then those are secondary tasks.

[quoted text, click to view]

This request does not make sense. The security prompt indicates a real
security misconfiguration on the server. How does one fabricate an
arbitrary NT user token out of an anonymous logon to pass NTFS
permissions? If this works, then what stops me from impersonating as
you or the administrator on the server.


If you can describe your customized situation as well as network
configuration further, then maybe someone can help. I can only say that
when I set up Sharepoint sites, by default it works without requiring
login prompts from my computers using my local login of a domain
account.



//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//


[quoted text, click to view]