|
|
You're in the
iis security
group:A little help (kerberos, netbios, and SPN... oh my!)
iis security:
secured using IWA and when the site is access by server name (QSERVER\internal) the domain user's credentials are passed automatically and everything is fine. This is good because we don't want internal users (people part of our domain) to have to enter a user/pass. However, one of the integrated ASP apps won't let us use an internal name because this intranet needs to be more of an extranet, so we have to use the FQDN. Our domains aren't the same (.local for the QSERVER and a .com for the FQDN). I've run "setspn -a host/www.oursite.com QSERVER" which I thought would allow requests from this host header to be passed with IWA, but it doesn't work. Our goal is to have ALL of our users, whether they are inside the office or outside, to use the same website address: http://www.oursite.com/internal but the internal users not have to enter a password, and all external users MUST enter one. Any suggestions? Server 2003 IIS6 web server is a DC Thanks!
set the site to windows integrated authentication, this will allow the local
users credentials to pass to the site. the outside users credentials will not pass thru, because they are not logged into the domain and are outside the firewall, assuming you are behind one. this will result in a login prompt, the only problem is they must supply the domain, username and password, unlike basic authentication, where you can supply the domain for them. also remember, if you are not using ssl, these credentials, from the outside, will be passed in clear text. [quoted text, click to view] "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message news:46a1ae9259f88c8678b28b7813c@news.giganews.com... >I have a custom intranet that I have setup for our company. The access is >secured using IWA and when the site is access by server name >(QSERVER\internal) the domain user's credentials are passed automatically >and everything is fine. This is good because we don't want internal users >(people part of our domain) to have to enter a user/pass. > > However, one of the integrated ASP apps won't let us use an internal name > because this intranet needs to be more of an extranet, so we have to use > the FQDN. Our domains aren't the same (.local for the QSERVER and a .com > for the FQDN). I've run "setspn -a host/www.oursite.com QSERVER" which I > thought would allow requests from this host header to be passed with IWA, > but it doesn't work. > > Our goal is to have ALL of our users, whether they are inside the office > or outside, to use the same website address: > http://www.oursite.com/internal but the internal users not have to enter a > password, and all external users MUST enter one. Any suggestions? > > Server 2003 > IIS6 > web server is a DC > > Thanks! > > C > >
Hello Consultant,
I'm sorry I wasn't more clear. When I referenced IWA, I was saying that the site IS using integrated windows auth. However, from outside using a non NETBIOS name (FQDN) the password isn't accepted. Thanks for your help! Craig [quoted text, click to view] > set the site to windows integrated authentication, this will allow the > local users credentials to pass to the site. the outside users > credentials will not pass thru, because they are not logged into the > domain and are outside the firewall, assuming you are behind one. this > will result in a login prompt, the only problem is they must supply > the domain, username and password, unlike basic authentication, where > you can supply the domain for them. also remember, if you are not > using ssl, these credentials, from the outside, will be passed in > clear text. > > "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message > news:46a1ae9259f88c8678b28b7813c@news.giganews.com... > >> I have a custom intranet that I have setup for our company. The >> access is secured using IWA and when the site is access by server >> name (QSERVER\internal) the domain user's credentials are passed >> automatically and everything is fine. This is good because we don't >> want internal users (people part of our domain) to have to enter a >> user/pass. >> >> However, one of the integrated ASP apps won't let us use an internal >> name because this intranet needs to be more of an extranet, so we >> have to use the FQDN. Our domains aren't the same (.local for the >> QSERVER and a .com for the FQDN). I've run "setspn -a >> host/www.oursite.com QSERVER" which I thought would allow requests >> from this host header to be passed with IWA, but it doesn't work. >> >> Our goal is to have ALL of our users, whether they are inside the >> office or outside, to use the same website address: >> http://www.oursite.com/internal but the internal users not have to >> enter a password, and all external users MUST enter one. Any >> suggestions? >> >> Server 2003 >> IIS6 >> web server is a DC >> Thanks! >> >> C >>
I take that back, that isn't exact. When www.site.com is used with IWA enabled,
instead of the netbios name, I am prompted for a U/P. When the netbios name is used there is no U/P prompted. (this is all on the internal network) I need to be able to use the public site name on the internal network and not get prompted for a password. Externally since there is no connection for kerberos, I'm sure it will fail over to NTLM and ask for a U/P. But why does the netbios name work and authenticate but the full website name does not? [quoted text, click to view] > Hello Consultant, > > I'm sorry I wasn't more clear. When I referenced IWA, I was saying > that the site IS using integrated windows auth. However, from outside > using a non NETBIOS name (FQDN) the password isn't accepted. Thanks > for your help! > > Craig > >> set the site to windows integrated authentication, this will allow >> the local users credentials to pass to the site. the outside users >> credentials will not pass thru, because they are not logged into the >> domain and are outside the firewall, assuming you are behind one. >> this will result in a login prompt, the only problem is they must >> supply the domain, username and password, unlike basic >> authentication, where you can supply the domain for them. also >> remember, if you are not using ssl, these credentials, from the >> outside, will be passed in clear text. >> >> "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message >> news:46a1ae9259f88c8678b28b7813c@news.giganews.com... >> >>> I have a custom intranet that I have setup for our company. The >>> access is secured using IWA and when the site is access by server >>> name (QSERVER\internal) the domain user's credentials are passed >>> automatically and everything is fine. This is good because we don't >>> want internal users (people part of our domain) to have to enter a >>> user/pass. >>> >>> However, one of the integrated ASP apps won't let us use an internal >>> name because this intranet needs to be more of an extranet, so we >>> have to use the FQDN. Our domains aren't the same (.local for the >>> QSERVER and a .com for the FQDN). I've run "setspn -a >>> host/www.oursite.com QSERVER" which I thought would allow requests >>> from this host header to be passed with IWA, but it doesn't work. >>> >>> Our goal is to have ALL of our users, whether they are inside the >>> office or outside, to use the same website address: >>> http://www.oursite.com/internal but the internal users not have to >>> enter a password, and all external users MUST enter one. Any >>> suggestions? >>> >>> Server 2003 >>> IIS6 >>> web server is a DC >>> Thanks! >>> C >>>
well, internet explorer see's the fqdn as a non trusted internet site and
won't pass the credentials. try adding the fqdn as a trusted site, this should allow the credentials to be passed. [quoted text, click to view] "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message news:46a1ae925f5b8c868463e11f41d@news.giganews.com... >I take that back, that isn't exact. When www.site.com is used with IWA >enabled, instead of the netbios name, I am prompted for a U/P. When the >netbios name is used there is no U/P prompted. (this is all on the >internal network) I need to be able to use the public site name on the >internal network and not get prompted for a password. Externally since >there is no connection for kerberos, I'm sure it will fail over to NTLM and >ask for a U/P. But why does the netbios name work and authenticate but the >full website name does not? > >> Hello Consultant, >> >> I'm sorry I wasn't more clear. When I referenced IWA, I was saying >> that the site IS using integrated windows auth. However, from outside >> using a non NETBIOS name (FQDN) the password isn't accepted. Thanks >> for your help! >> >> Craig >> >>> set the site to windows integrated authentication, this will allow >>> the local users credentials to pass to the site. the outside users >>> credentials will not pass thru, because they are not logged into the >>> domain and are outside the firewall, assuming you are behind one. >>> this will result in a login prompt, the only problem is they must >>> supply the domain, username and password, unlike basic >>> authentication, where you can supply the domain for them. also >>> remember, if you are not using ssl, these credentials, from the >>> outside, will be passed in clear text. >>> >>> "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message >>> news:46a1ae9259f88c8678b28b7813c@news.giganews.com... >>> >>>> I have a custom intranet that I have setup for our company. The >>>> access is secured using IWA and when the site is access by server >>>> name (QSERVER\internal) the domain user's credentials are passed >>>> automatically and everything is fine. This is good because we don't >>>> want internal users (people part of our domain) to have to enter a >>>> user/pass. >>>> >>>> However, one of the integrated ASP apps won't let us use an internal >>>> name because this intranet needs to be more of an extranet, so we >>>> have to use the FQDN. Our domains aren't the same (.local for the >>>> QSERVER and a .com for the FQDN). I've run "setspn -a >>>> host/www.oursite.com QSERVER" which I thought would allow requests >>>> from this host header to be passed with IWA, but it doesn't work. >>>> >>>> Our goal is to have ALL of our users, whether they are inside the >>>> office or outside, to use the same website address: >>>> http://www.oursite.com/internal but the internal users not have to >>>> enter a password, and all external users MUST enter one. Any >>>> suggestions? >>>> >>>> Server 2003 >>>> IIS6 >>>> web server is a DC >>>> Thanks! >>>> C >>>> > >
Hello Consultant,
I added the site to IE's trusted list and tried the portion that has IWA enabled and it still asks for a U/P. Any other hints or tips? [quoted text, click to view] > well, internet explorer see's the fqdn as a non trusted internet site > and won't pass the credentials. try adding the fqdn as a trusted site, > this should allow the credentials to be passed. > > "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message > news:46a1ae925f5b8c868463e11f41d@news.giganews.com... > >> I take that back, that isn't exact. When www.site.com is used with >> IWA enabled, instead of the netbios name, I am prompted for a U/P. >> When the netbios name is used there is no U/P prompted. (this is all >> on the internal network) I need to be able to use the public site >> name on the internal network and not get prompted for a password. >> Externally since there is no connection for kerberos, I'm sure it >> will fail over to NTLM and ask for a U/P. But why does the netbios >> name work and authenticate but the full website name does not? >> >>> Hello Consultant, >>> >>> I'm sorry I wasn't more clear. When I referenced IWA, I was saying >>> that the site IS using integrated windows auth. However, from >>> outside using a non NETBIOS name (FQDN) the password isn't accepted. >>> Thanks for your help! >>> >>> Craig >>> >>>> set the site to windows integrated authentication, this will allow >>>> the local users credentials to pass to the site. the outside users >>>> credentials will not pass thru, because they are not logged into >>>> the domain and are outside the firewall, assuming you are behind >>>> one. this will result in a login prompt, the only problem is they >>>> must supply the domain, username and password, unlike basic >>>> authentication, where you can supply the domain for them. also >>>> remember, if you are not using ssl, these credentials, from the >>>> outside, will be passed in clear text. >>>> >>>> "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message >>>> news:46a1ae9259f88c8678b28b7813c@news.giganews.com... >>>> >>>>> I have a custom intranet that I have setup for our company. The >>>>> access is secured using IWA and when the site is access by server >>>>> name (QSERVER\internal) the domain user's credentials are passed >>>>> automatically and everything is fine. This is good because we >>>>> don't want internal users (people part of our domain) to have to >>>>> enter a user/pass. >>>>> >>>>> However, one of the integrated ASP apps won't let us use an >>>>> internal name because this intranet needs to be more of an >>>>> extranet, so we have to use the FQDN. Our domains aren't the same >>>>> (.local for the QSERVER and a .com for the FQDN). I've run >>>>> "setspn -a host/www.oursite.com QSERVER" which I thought would >>>>> allow requests from this host header to be passed with IWA, but it >>>>> doesn't work. >>>>> >>>>> Our goal is to have ALL of our users, whether they are inside the >>>>> office or outside, to use the same website address: >>>>> http://www.oursite.com/internal but the internal users not have to >>>>> enter a password, and all external users MUST enter one. Any >>>>> suggestions? >>>>> >>>>> Server 2003 >>>>> IIS6 >>>>> web server is a DC >>>>> Thanks! >>>>>
Hi,
Add it to the Intranet zone, not Trusted Sites. See: http://support.microsoft.com/?id=258063 You will also be prompted if automatic logon fails because: a) the currently logged on user does not have access b) the configured authentication mechanism is failing (e.g. you are using Kerberos and you can't access the DC, or you are using NTLM but you are going through a proxy server, or HTTP Keep-Alives are not enabled) Cheers Ken [quoted text, click to view] "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message news:46a1ae9261c28c868de7b273470@news.giganews.com... > Hello Consultant, > > I added the site to IE's trusted list and tried the portion that has IWA > enabled and it still asks for a U/P. Any other hints or tips? > >> well, internet explorer see's the fqdn as a non trusted internet site >> and won't pass the credentials. try adding the fqdn as a trusted site, >> this should allow the credentials to be passed. >> >> "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message >> news:46a1ae925f5b8c868463e11f41d@news.giganews.com... >> >>> I take that back, that isn't exact. When www.site.com is used with >>> IWA enabled, instead of the netbios name, I am prompted for a U/P. >>> When the netbios name is used there is no U/P prompted. (this is all >>> on the internal network) I need to be able to use the public site >>> name on the internal network and not get prompted for a password. >>> Externally since there is no connection for kerberos, I'm sure it >>> will fail over to NTLM and ask for a U/P. But why does the netbios >>> name work and authenticate but the full website name does not? >>> >>>> Hello Consultant, >>>> >>>> I'm sorry I wasn't more clear. When I referenced IWA, I was saying >>>> that the site IS using integrated windows auth. However, from >>>> outside using a non NETBIOS name (FQDN) the password isn't accepted. >>>> Thanks for your help! >>>> >>>> Craig >>>> >>>>> set the site to windows integrated authentication, this will allow >>>>> the local users credentials to pass to the site. the outside users >>>>> credentials will not pass thru, because they are not logged into >>>>> the domain and are outside the firewall, assuming you are behind >>>>> one. this will result in a login prompt, the only problem is they >>>>> must supply the domain, username and password, unlike basic >>>>> authentication, where you can supply the domain for them. also >>>>> remember, if you are not using ssl, these credentials, from the >>>>> outside, will be passed in clear text. >>>>> >>>>> "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message >>>>> news:46a1ae9259f88c8678b28b7813c@news.giganews.com... >>>>> >>>>>> I have a custom intranet that I have setup for our company. The >>>>>> access is secured using IWA and when the site is access by server >>>>>> name (QSERVER\internal) the domain user's credentials are passed >>>>>> automatically and everything is fine. This is good because we >>>>>> don't want internal users (people part of our domain) to have to >>>>>> enter a user/pass. >>>>>> >>>>>> However, one of the integrated ASP apps won't let us use an >>>>>> internal name because this intranet needs to be more of an >>>>>> extranet, so we have to use the FQDN. Our domains aren't the same >>>>>> (.local for the QSERVER and a .com for the FQDN). I've run >>>>>> "setspn -a host/www.oursite.com QSERVER" which I thought would >>>>>> allow requests from this host header to be passed with IWA, but it >>>>>> doesn't work. >>>>>> >>>>>> Our goal is to have ALL of our users, whether they are inside the >>>>>> office or outside, to use the same website address: >>>>>> http://www.oursite.com/internal but the internal users not have to >>>>>> enter a password, and all external users MUST enter one. Any >>>>>> suggestions? >>>>>> >>>>>> Server 2003 >>>>>> IIS6 >>>>>> web server is a DC >>>>>> Thanks! >>>>>> C > >
Hello Ken,
Thanks Ken. I was able to get it working with Intranet sites. The issue was that I was using a HOSTS file to map the domain that will be used in the future, and it did not seem to like that. I since then used DNS to change the name properly and it all functions. Thanks for all of your help everyone. Craig [quoted text, click to view] > Hi, > > Add it to the Intranet zone, not Trusted Sites. See: > http://support.microsoft.com/?id=258063 > > You will also be prompted if automatic logon fails because: > a) the currently logged on user does not have access > b) the configured authentication mechanism is failing (e.g. you are > using > Kerberos and you can't access the DC, or you are using NTLM but you > are > going through a proxy server, or HTTP Keep-Alives are not enabled) > Cheers > Ken > "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message > news:46a1ae9261c28c868de7b273470@news.giganews.com... > >> Hello Consultant, >> >> I added the site to IE's trusted list and tried the portion that has >> IWA enabled and it still asks for a U/P. Any other hints or tips? >> >>> well, internet explorer see's the fqdn as a non trusted internet >>> site and won't pass the credentials. try adding the fqdn as a >>> trusted site, this should allow the credentials to be passed. >>> >>> "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message >>> news:46a1ae925f5b8c868463e11f41d@news.giganews.com... >>> >>>> I take that back, that isn't exact. When www.site.com is used with >>>> IWA enabled, instead of the netbios name, I am prompted for a U/P. >>>> When the netbios name is used there is no U/P prompted. (this is >>>> all on the internal network) I need to be able to use the public >>>> site name on the internal network and not get prompted for a >>>> password. Externally since there is no connection for kerberos, I'm >>>> sure it will fail over to NTLM and ask for a U/P. But why does the >>>> netbios name work and authenticate but the full website name does >>>> not? >>>> >>>>> Hello Consultant, >>>>> >>>>> I'm sorry I wasn't more clear. When I referenced IWA, I was >>>>> saying that the site IS using integrated windows auth. However, >>>>> from outside using a non NETBIOS name (FQDN) the password isn't >>>>> accepted. Thanks for your help! >>>>> >>>>> Craig >>>>> >>>>>> set the site to windows integrated authentication, this will >>>>>> allow the local users credentials to pass to the site. the >>>>>> outside users credentials will not pass thru, because they are >>>>>> not logged into the domain and are outside the firewall, assuming >>>>>> you are behind one. this will result in a login prompt, the only >>>>>> problem is they must supply the domain, username and password, >>>>>> unlike basic authentication, where you can supply the domain for >>>>>> them. also remember, if you are not using ssl, these credentials, >>>>>> from the outside, will be passed in clear text. >>>>>> >>>>>> "Craig Carrigan" <craig@userfriendlyhhi.com> wrote in message >>>>>> news:46a1ae9259f88c8678b28b7813c@news.giganews.com... >>>>>> >>>>>>> I have a custom intranet that I have setup for our company. The >>>>>>> access is secured using IWA and when the site is access by >>>>>>> server name (QSERVER\internal) the domain user's credentials are >>>>>>> passed automatically and everything is fine. This is good >>>>>>> because we don't want internal users (people part of our domain) >>>>>>> to have to enter a user/pass. >>>>>>> >>>>>>> However, one of the integrated ASP apps won't let us use an >>>>>>> internal name because this intranet needs to be more of an >>>>>>> extranet, so we have to use the FQDN. Our domains aren't the >>>>>>> same (.local for the QSERVER and a .com for the FQDN). I've run >>>>>>> "setspn -a host/www.oursite.com QSERVER" which I thought would >>>>>>> allow requests from this host header to be passed with IWA, but >>>>>>> it doesn't work. >>>>>>> >>>>>>> Our goal is to have ALL of our users, whether they are inside >>>>>>> the office or outside, to use the same website address: >>>>>>> http://www.oursite.com/internal but the internal users not have >>>>>>> to enter a password, and all external users MUST enter one. Any >>>>>>> suggestions? >>>>>>> >>>>>>> Server 2003 >>>>>>> IIS6 >>>>>>> web server is a DC >>>>>>> Thanks! >>>>>>> C
Don't see what you're looking for? Try a search.
|
June 2003
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
December 2007
January 2008
February 2008
March 2008
April 2008
May 2008
June 2008
| home · blog · groups | Questions? Comments? Contact the dn |