Home All Groups Group Topic Archive Search About

Getting prompted on IIS web

Author
4 Apr 2005 6:25 PM
Keith-Earl
We have run a .NET app on a test and prod server for months. We are running
IIS 5 on Windows 2000 and are fully patched with current versions of ADO.
In order to browse the application we only use the server name in the URL.
For example:  http://MyServer/MyApp/default.aspx  . We are not prompted for
our credentials because we only have Windows authentication enabled.

Some of our end users have used the fully qualified domain name.  For
example: http://MyServer.MyDomain.Com/MyApp/default.aspx . At this point we
are prompted for our credentials even though it is the same web app.
Authentication method has not changed, only the URL now uses the entire
domain name.

What gives?

We ran FileMon on the servers and only got SUCCESS for all file access.
When we tracert we get the same (two hop) results.

Why does the slight change in the URL cause us to get prompted?  Could it be
that the first solution uses a different domain controller to authenticate
than the second?

Many thanks,

Keith

Author
5 Apr 2005 5:09 AM
Jason Brown [MSFT]
It's to do with your IE security Zones. surf to the FQDN and make a note of
the zone (bottom right on the staus bar). then do the same on the netbios
name. See the difference?

Add the FQDN to the intranet or trusted zone and the problem ought to go
away


--
Jason Brown
Microsoft GTSC, IIS

This posting is provided "AS IS" with no warranties, and confers no rights.

Show quoteHide quote
"Keith-Earl" <k@k.com> wrote in message
news:uwax2OUOFHA.2604@TK2MSFTNGP10.phx.gbl...
> We have run a .NET app on a test and prod server for months. We are
> running IIS 5 on Windows 2000 and are fully patched with current versions
> of ADO. In order to browse the application we only use the server name in
> the URL. For example:  http://MyServer/MyApp/default.aspx  . We are not
> prompted for our credentials because we only have Windows authentication
> enabled.
>
> Some of our end users have used the fully qualified domain name.  For
> example: http://MyServer.MyDomain.Com/MyApp/default.aspx . At this point
> we are prompted for our credentials even though it is the same web app.
> Authentication method has not changed, only the URL now uses the entire
> domain name.
>
> What gives?
>
> We ran FileMon on the servers and only got SUCCESS for all file access.
> When we tracert we get the same (two hop) results.
>
> Why does the slight change in the URL cause us to get prompted?  Could it
> be that the first solution uses a different domain controller to
> authenticate than the second?
>
> Many thanks,
>
> Keith
>
Author
5 Apr 2005 7:10 AM
WenJun Zhang[msft]
Hi Keith,

When using FQDN/DNS name, IE will consider it's an internet site and
therefore it will not send credential to IIS to automatically perform
integrated authentication. The work around is explicitly adding the
FQDN into IE intranet or trusted zone. All the detailed info is
explained in the following article:

Internet Explorer May Prompt You for a Password
http://support.microsoft.com/?id=258063

Thanks.

Best regards,

WenJun Zhang
Microsoft Online Partner Support

When responding to posts, please "Reply to Group" via your newsreader
so that others may learn and benefit from your issue.

=====================================================

Business-Critical Phone Support (BCPS) provides you with technical
phone support at no charge during critical LAN outages or "business
down" situations. This benefit is available 24 hours a day, 7 days a
week to all Microsoft technology partners in the United States and
Canada.

This and other support options are available here:

BCPS:
https://partner.microsoft.com/US/technicalsupport/supportoverview/4001
0469
Others:
https://partner.microsoft.com/US/technicalsupport/supportoverview/

If you are outside the United States, please visit our International
Support page: http://support.microsoft.com/common/international.aspx

=====================================================

This posting is provided "AS IS" with no warranties, and confers no
rights.
Author
5 Apr 2005 7:02 PM
Keith-Earl
Thank you both. Will try when I put out this fire first.

Is there a way to automatically add the FQDN to the Intranet Zone?  We do
not want our end-users to ever get prompted because this truly is an
intranet app.

many, many thanks,

Keith


""WenJun Zhang[msft]"" <v-wzh***@online.microsoft.com> wrote in message
Show quoteHide quote
news:lcKte6aOFHA.2944@TK2MSFTNGXA01.phx.gbl...
> Hi Keith,
>
> When using FQDN/DNS name, IE will consider it's an internet site and
> therefore it will not send credential to IIS to automatically perform
> integrated authentication. The work around is explicitly adding the
> FQDN into IE intranet or trusted zone. All the detailed info is
> explained in the following article:
>
> Internet Explorer May Prompt You for a Password
> http://support.microsoft.com/?id=258063
>
> Thanks.
>
> Best regards,
>
> WenJun Zhang
> Microsoft Online Partner Support
>
> When responding to posts, please "Reply to Group" via your newsreader
> so that others may learn and benefit from your issue.
>
> =====================================================
>
> Business-Critical Phone Support (BCPS) provides you with technical
> phone support at no charge during critical LAN outages or "business
> down" situations. This benefit is available 24 hours a day, 7 days a
> week to all Microsoft technology partners in the United States and
> Canada.
>
> This and other support options are available here:
>
> BCPS:
> https://partner.microsoft.com/US/technicalsupport/supportoverview/4001
> 0469
> Others:
> https://partner.microsoft.com/US/technicalsupport/supportoverview/
>
> If you are outside the United States, please visit our International
> Support page: http://support.microsoft.com/common/international.aspx
>
> =====================================================
>
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
Author
6 Apr 2005 5:37 AM
Ken Schaefer
Use Group Policy

Cheers
Ken

Show quoteHide quote
"Keith-Earl" <k@k.com> wrote in message
news:uAgAMIhOFHA.2468@tk2msftngp13.phx.gbl...
: Thank you both. Will try when I put out this fire first.
:
: Is there a way to automatically add the FQDN to the Intranet Zone?  We do
: not want our end-users to ever get prompted because this truly is an
: intranet app.
:
: many, many thanks,
:
: Keith
:
:
: ""WenJun Zhang[msft]"" <v-wzh***@online.microsoft.com> wrote in message
: news:lcKte6aOFHA.2944@TK2MSFTNGXA01.phx.gbl...
: > Hi Keith,
: >
: > When using FQDN/DNS name, IE will consider it's an internet site and
: > therefore it will not send credential to IIS to automatically perform
: > integrated authentication. The work around is explicitly adding the
: > FQDN into IE intranet or trusted zone. All the detailed info is
: > explained in the following article:
: >
: > Internet Explorer May Prompt You for a Password
: > http://support.microsoft.com/?id=258063
: >
: > Thanks.
: >
: > Best regards,
: >
: > WenJun Zhang
: > Microsoft Online Partner Support
: >
: > When responding to posts, please "Reply to Group" via your newsreader
: > so that others may learn and benefit from your issue.
: >
: > =====================================================
: >
: > Business-Critical Phone Support (BCPS) provides you with technical
: > phone support at no charge during critical LAN outages or "business
: > down" situations. This benefit is available 24 hours a day, 7 days a
: > week to all Microsoft technology partners in the United States and
: > Canada.
: >
: > This and other support options are available here:
: >
: > BCPS:
: > https://partner.microsoft.com/US/technicalsupport/supportoverview/4001
: > 0469
: > Others:
: > https://partner.microsoft.com/US/technicalsupport/supportoverview/
: >
: > If you are outside the United States, please visit our International
: > Support page: http://support.microsoft.com/common/international.aspx
: >
: > =====================================================
: >
: > This posting is provided "AS IS" with no warranties, and confers no
: > rights.
: >
:
:
Author
6 Apr 2005 9:44 AM
WenJun Zhang[msft]
Keith,

In case all the client machines are in the same domain, using group
policy will help you achieve this.

How To Set Advanced Settings In Internet Explorer by Using Group
Policy Objects
http://support.microsoft.com/kb/274846/

Best regards,

WenJun Zhang
Microsoft Online Partner Support

This posting is provided "AS IS" with no warranties, and confers no
rights.
Author
12 Apr 2005 12:12 PM
Keith-Earl
Perfect. Thanks.
Author
13 Apr 2005 9:10 AM
WenJun Zhang[msft]
You are welcome.

Best regards,

WenJun Zhang
Microsoft Online Partner Support

This posting is provided "AS IS" with no warranties, and confers no
rights.
Author
9 Apr 2005 10:50 AM
anonymous
>-----Original Message-----
>We have run a .NET app on a test and prod server for
months. We are running
>IIS 5 on Windows 2000 and are fully patched with current
versions of ADO.
>In order to browse the application we only use the server
name in the URL.
>For example:  http://MyServer/MyApp/default.aspx  . We
are not prompted for
>our credentials because we only have Windows
authentication enabled.
>
>Some of our end users have used the fully qualified
domain name.  For
>example:
http://MyServer.MyDomain.Com/MyApp/default.aspx . At this
point we
>are prompted for our credentials even though it is the
same web app.
>Authentication method has not changed, only the URL now
uses the entire
>domain name.
>
>What gives?
>
>We ran FileMon on the servers and only got SUCCESS for
all file access.
>When we tracert we get the same (two hop) results.
>
>Why does the slight change in the URL cause us to get
prompted?  Could it be
>that the first solution uses a different domain
controller to authenticate
Show quoteHide quote
>than the second?
>
>Many thanks,
>
>Keith
>
>
>.
>