Groups | Blog | Home
all groups > iis security > june 2008 >

iis security : Unwanted login request


Ben
6/20/2008 1:05:53 PM
Problem: trying to move web sites to a second controller in my domain, and
I'm getting unwanted request for authentication.

Detail: when the IP address of the site is on the domain controller, I
attempt to access it with IE. If I've set the site up in IIS, I see it, if
I don't, I get a page not found. As expected. If I move the IP to the
second controller, and attempt to access it with IE, I get an immediate
request for user ID and password, whether or not the site is defined in IIS.
As a side note, any new sites I set up can be accessed without the user ID /
password request appearing.

Am I missing some permission somewhere? What do I need to do to resolve
this?
Thanks in advance,

Ben
David Wang
6/21/2008 3:05:46 PM
[quoted text, click to view]



If you get a request for user ID and password and the site is NOT
defined in IIS, then either the request is not going to that second
controller, or it's not going to the site you expect on that second
controller. If the request is not going to the correct computer, all
bets are off as to the intended behavior because you're not describing
the corresponding configuration.

The authentication protocols provided by IIS does not discriminate
between any of its sites. Thus, the issue of "unwanted login request"
is a client-side issue because when you enable authentication and are
certain the requests went to the right web server, the web server will
*always* challenge for authentication -- that is what it means. It is
up to the client to decide how to auto-login and if unsuccessful, you
get the login dialog.

Based on your description, I do not think there is anything wrong from
an IIS perspective. If you use IP address, then the browser is not
going to auto-login by default (it's a dotted address) and could
explain what you observe.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
AddThis Social Bookmark Button