IE 7 and integrated windows authentication

Discussion in 'Internet Explorer' started by Tim, Oct 19, 2006.

  1. Tim

    Tim Guest

    I just installed IE 7. We have a intranet site running on IIS 6 that uses
    windows authentication. With IE 6 everything worked fine. Now with IE 7 it is
    prompting me to login. I checked to make sure the IE setting to use
    integrated windows authentication was enabled. Is this a bug in IE 7? Are
    there work arounds?

    Thanks,

    Tim
     
    Tim, Oct 19, 2006
    #1
    1. Advertisements

  2. Tim

    Tim Guest

    Has anyone else been able to duplicate this problem, or is it just me? Any
    thoughts on a solution?

    Thanks,
     
    Tim, Oct 20, 2006
    #2
    1. Advertisements

  3. Tim

    MarkN Guest

    Yes, we having this problem too. Here's what I know about the problem so far:

    1. IE7 is the first version of IE to use Kerberos. IE6 used NTLM. I need to
    verify if this is accurate or not, but it's what I read.

    2. Because IE7 uses Kerberos, IIS6 starts with negotiate and asks the
    browser if it supports Kerberos. In IE6, the answer was no, so NTLM was used.
    In IE7 the answer is yes, so Kerberos is used.

    3. As far as I can tell, NTLM can authenticate via another server, Kerberos
    can't. This is why it pops up a login box.

    4. To fix, you can obtain a hot fix from Microsoft to force IIS6 to only
    authenticate using NTLM (this works) or you can disable Integrated Windows
    Authentication in the browser (Tools, Internet Options, Advanced, Security,
    uncheck Enable Integrated Windows Authentication). The reason why disabling
    integrated windows authentication works is unclear, but it still actually
    uses integrated windows authentication with this option off, but seems to use
    NTLM.

    5. Also try accessing your site by IP address rather than machine name.
    (this works on our intranet, although I don't know why - perhaps the name
    resolution server stuffs up something with Kerberos authentication).
     
    MarkN, Jan 20, 2007
    #3
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.