|
security
newsgroups
|
|||||||||||||||||||||||
|
|||||||||||||||||||||||
Passing User Credentials to site running under Integrated SecurityOur intranet is running under windows integrated security. We have
domain users that want to access our intranet site via ssl vpn. SSL VPN can not authenticate against services that run under windows integrated security. In order to get around this issue it seems that we would need to create a login page on a separate site that runs under anonymous security. Then pass the users credentials to the site running under integrated security. Has anyone had this issue or done anything like this before? Is it even possible to pass user credentils to a site running under integrated security? <cdlipf***@hotmail.com> wrote in message
news:1118099319.122602.307040@g47g2000cwa.googlegroups.com... That's not necessarily true. Have you actually tested this from a VPN > Our intranet is running under windows integrated security. We have > domain users that want to access our intranet site via ssl vpn. SSL > VPN can not authenticate against services that run under windows > integrated security. client? > In order to get around this issue it seems that we If Windows authentication really doesn't work, perhaps basic authentication > would need to create a login page on a separate site that runs under > anonymous security. Then pass the users credentials to the site > running under integrated security. might? This would allow you to support VPN clients with far less changes to your current application. > Has anyone had this issue or done Yes, but without any problems. Are you actually seeing a specific problem? > anything like this before? Is it even possible to pass user credentils > to a site running under integrated security? If so, what is it? If not, why not test authentication over VPN against a simple sample application? Using a Cisco VPN client, everything works fine. We are using a thrid
party product that does SSL VPN. VPN via http/ssl. This is where we run into problems. because the browser client cannot pass user credentials to our iis server which is set to run under integrated security. Nicole Calinoiu wrote: Show quoteHide quote > <cdlipf***@hotmail.com> wrote in message > news:1118099319.122602.307040@g47g2000cwa.googlegroups.com... > > Our intranet is running under windows integrated security. We have > > domain users that want to access our intranet site via ssl vpn. SSL > > VPN can not authenticate against services that run under windows > > integrated security. > > That's not necessarily true. Have you actually tested this from a VPN > client? > > > > In order to get around this issue it seems that we > > would need to create a login page on a separate site that runs under > > anonymous security. Then pass the users credentials to the site > > running under integrated security. > > If Windows authentication really doesn't work, perhaps basic authentication > might? This would allow you to support VPN clients with far less changes to > your current application. > > > > Has anyone had this issue or done > > anything like this before? Is it even possible to pass user credentils > > to a site running under integrated security? > > Yes, but without any problems. Are you actually seeing a specific problem? > If so, what is it? If not, why not test authentication over VPN against a > simple sample application? We are recieving the following error "HTTP Error 400 - Request is badly
formed." I believe we are receiving the error because the SSL VPN client is attempting to send a Kerberos ticket and our IIS server is expecting NTLM. cdlipf***@hotmail.com wrote: Show quoteHide quote > Using a Cisco VPN client, everything works fine. We are using a thrid > party product that does SSL VPN. VPN via http/ssl. This is where we > run into problems. because the browser client cannot pass user > credentials to our iis server which is set to run under integrated > security. > > > Nicole Calinoiu wrote: > > <cdlipf***@hotmail.com> wrote in message > > news:1118099319.122602.307040@g47g2000cwa.googlegroups.com... > > > Our intranet is running under windows integrated security. We have > > > domain users that want to access our intranet site via ssl vpn. SSL > > > VPN can not authenticate against services that run under windows > > > integrated security. > > > > That's not necessarily true. Have you actually tested this from a VPN > > client? > > > > > > > In order to get around this issue it seems that we > > > would need to create a login page on a separate site that runs under > > > anonymous security. Then pass the users credentials to the site > > > running under integrated security. > > > > If Windows authentication really doesn't work, perhaps basic authentication > > might? This would allow you to support VPN clients with far less changes to > > your current application. > > > > > > > Has anyone had this issue or done > > > anything like this before? Is it even possible to pass user credentils > > > to a site running under integrated security? > > > > Yes, but without any problems. Are you actually seeing a specific problem? > > If so, what is it? If not, why not test authentication over VPN against a > > simple sample application? Is there anything in the httperr.log file that might give you a clue as to
why IIS thinks the request is badly formed? Cheers Ken -- Show quoteHide quoteIIS Blog: www.adopenstatic.com/cs/blogs/ken/ Web: www.adopenstatic.com <cdlipf***@hotmail.com> wrote in message news:1118184539.429922.196550@g47g2000cwa.googlegroups.com... : We are recieving the following error "HTTP Error 400 - Request is badly : formed." I believe we are receiving the error because the SSL VPN : client is attempting to send a Kerberos ticket and our IIS server is : expecting NTLM. : : cdlipf***@hotmail.com wrote: : > Using a Cisco VPN client, everything works fine. We are using a thrid : > party product that does SSL VPN. VPN via http/ssl. This is where we : > run into problems. because the browser client cannot pass user : > credentials to our iis server which is set to run under integrated : > security. : > : > : > Nicole Calinoiu wrote: : > > <cdlipf***@hotmail.com> wrote in message : > > news:1118099319.122602.307040@g47g2000cwa.googlegroups.com... : > > > Our intranet is running under windows integrated security. We have : > > > domain users that want to access our intranet site via ssl vpn. SSL : > > > VPN can not authenticate against services that run under windows : > > > integrated security. : > > : > > That's not necessarily true. Have you actually tested this from a VPN : > > client? : > > : > > : > > > In order to get around this issue it seems that we : > > > would need to create a login page on a separate site that runs under : > > > anonymous security. Then pass the users credentials to the site : > > > running under integrated security. : > > : > > If Windows authentication really doesn't work, perhaps basic authentication : > > might? This would allow you to support VPN clients with far less changes to : > > your current application. : > > : > > : > > > Has anyone had this issue or done : > > > anything like this before? Is it even possible to pass user credentils : > > > to a site running under integrated security? : > > : > > Yes, but without any problems. Are you actually seeing a specific problem? : > > If so, what is it? If not, why not test authentication over VPN against a : > > simple sample application? : This sort of thing is not a general SSL VPN problem, so it might be a good
idea to get in touch with the VPN vendor to see if this is a known issue with their product and if there might be some configuration changes you could apply to avoid it. Failing that, you might want to try allowing basic authentication on the app (after making sure the app requires https use). <cdlipf***@hotmail.com> wrote in message Show quoteHide quote news:1118184539.429922.196550@g47g2000cwa.googlegroups.com... > We are recieving the following error "HTTP Error 400 - Request is badly > formed." I believe we are receiving the error because the SSL VPN > client is attempting to send a Kerberos ticket and our IIS server is > expecting NTLM. > > cdlipf***@hotmail.com wrote: >> Using a Cisco VPN client, everything works fine. We are using a thrid >> party product that does SSL VPN. VPN via http/ssl. This is where we >> run into problems. because the browser client cannot pass user >> credentials to our iis server which is set to run under integrated >> security. >> >> >> Nicole Calinoiu wrote: >> > <cdlipf***@hotmail.com> wrote in message >> > news:1118099319.122602.307040@g47g2000cwa.googlegroups.com... >> > > Our intranet is running under windows integrated security. We have >> > > domain users that want to access our intranet site via ssl vpn. SSL >> > > VPN can not authenticate against services that run under windows >> > > integrated security. >> > >> > That's not necessarily true. Have you actually tested this from a VPN >> > client? >> > >> > >> > > In order to get around this issue it seems that we >> > > would need to create a login page on a separate site that runs under >> > > anonymous security. Then pass the users credentials to the site >> > > running under integrated security. >> > >> > If Windows authentication really doesn't work, perhaps basic >> > authentication >> > might? This would allow you to support VPN clients with far less >> > changes to >> > your current application. >> > >> > >> > > Has anyone had this issue or done >> > > anything like this before? Is it even possible to pass user >> > > credentils >> > > to a site running under integrated security? >> > >> > Yes, but without any problems. Are you actually seeing a specific >> > problem? >> > If so, what is it? If not, why not test authentication over VPN >> > against a >> > simple sample application? >  
Other interesting topics
Secure website (cookie/session)
secure site - multiple users w/ 1 user account? Making unique URL - internal and external Anonymous access not working IIS 6 and % characters in a URL Your opinion on SSL and common URL to access site from internal and external IP address and domain name restrictions not available?. SSL for FTP Application Identity windows integrated authentication |
|||||||||||||||||||||||
