Weird IIS with Windows Authentication + IE problem
- by Paulius Maruška
Hello.
I have a website running on IIS and using Windows Authentication. All users that are configured to get access to the site are form a AD domain (not local users). In the properties of a Website, I have set to use the AD domain as the realm.
Now, when using Firefox, Safari or Chrome - Everything is fine. When the user tries to open the site, he get's the login box. he enters simply "username" and "password" (let's pretend that it's an actual login and password :P) and he get's into the site.
When using IE, however, things get nasty. When the user tries to open the site - he get's the login box. User enters the "username" and "password" again, but those get rejected! And when the second time login box pops up - it has the username filled in as "web-server-domain-name\username" which is wrong, because web-server-domain-name is not the domain where all users reside (it's "ad-domain"). I've spent days trying to figure out what's going on...
Note, that if I manually enter "ad-domain\username" - I get accepted into the site without problems. So, my guess is that IE sends wrong username if domain is not specified.
Anyway, IE is the only browser that triggers this behavior!
Is it possible to do a server-side fix? Maybe it's possible to somehow auto-map the users to AD users?
If it's not solvable server-side - is there a client-side fix for this?
Thank you.
PS: I'm more of a programmer than a sys-admin, so configuring servers isn't the strong side of mine... :P
UPDATE:
@Evan: Yes, "Digest authentication for Windows domain servers" is also enabled.
@Eric: IIS version is 6.0. The authentication methods enabled are: Integrated and digest - all other methods are disabled.
As for the security log. I looked at it, when doing "username" and "password" login in Chrome/Firefox and when doing "ad-domain\username" and "password" login from IE - the generated log messages are the same (I see no difference, anyway). When entering "username" and "password" I don't see any errors in the security (or any other) log, so can't tell what method it's trying to use.
UPDATE 2:
As suggested by Eric in the comments - I played around with Fiddler... While playing with it, I noticed, that when "username" and "password" is entered in FF and IE - the "Authorization" header value (encrypted) sent by IE is longer (almost two times) than one sent by FF.
I tried to disable Windows Integrated authentication and only leave the Digest enabled - that fixed the problem (meaning, IE used the right realm just like other browsers), but that caused bazillion other problems with my site, because with Digest - user impersonation on the server doesn't work (that causes problems, when connecting to database etc).
Any ideas?
