Avoid popups with integrated security

[tvbruwae]

Hi

On our intranet we are using a combination of basic and integrated security. For most people access is granted transparently, but for others a popup is shown asking for credentials. When filling in their domain account and password they are granted access. If they choose to cancel, they get "HTTP 401.2 - Unauthorized: Logon failed due to server configuration"..

Is there an explanation why IIS sometimes shows a popup asking for user credentials and sometimes not? All users and computers are members of the domain and have fairly recent computers (IE 6).

Thanks!
Tim

 

[Sheco]

IIS does not show the popup... the browser does.

Assuming Internet Explorer is the browser...

1. Browser sends HTTP Request to IIS.

2. IIS checks to see if requested resource exists, if not return 404 error to browser.

3. IIS checks to see if the credentials sent with HTTP Request are sufficient to access resource, if not return 401 error to browser.

4. [highlight]Upon receiving a 401 from the server[/highlight], if previous request did not include credentials, Internet Explorer may automatically re-submit the HTTP Request, this time using the credentials. If previous request DID include the credentials of the current user, or IE is unable to determine the correct credentials, then [highlight]IE will show the login promt. [/highlight]

5. All subsequent Requests made by the browser to this particular server will include these credentials until either IE is closed or another 401 is received from this particular server.



PS: By default the Firefox browser does not automatically resubmit HTTP Requests ... it always prompts on 401.

 

[tvbruwae]

Hi Sheco, thank you for the info! We will do some more tests with the IE authentication options to see what happens, perhaps some settings are not set correctly on the client computers.