IIS authentication and name resolution with WINS vs DNS

[JGALEY]

I developed a web site running on IIS 6. Anonymous is checked off, integrated windows authentication is turned on. It is an ASP.NET site.

If I connect to this site using

http://servername/virtualdirectoryname,

all is well. It goes to the document listed under documents for the default/home page

If I connect using

http://servername.domainname.org/virtualdirectoryname,

I get prompted for logon and password, even though my AD credentials give me access to the site. I can enter my logon and password and get in, but I should not have to do that.

If I turn anonymous access on (leaving integrated checked, too), I can connect, but I need to restrict access to this site and do not want anonymous users on it.

Any ideas why it works ok when resolving the name via NETBIOS name (WINS) vs. via DNS??

Thanks in advance,

Jason

 

[mrdenny]

Jason,
I just looked at one of my IIS 6 servers and it's got the same problem when I go by IP to the server instead of by hostname.

Have you found any resolution yet?

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(Not quite so old any more.)

 

[mrdenny]

I'm looking at the logs for IIS and I'm seeing something strange.

If I connect to the root of the site by IP I get the following info in the log. When I connect by IP it isn't logging my username. When I connect via machine name by account info is there. It's very strange.

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(Not quite so old any more.)

 

[JGALEY]

I did find that if I set the browser (IE) to put the site in either the Intranet zone, and made sure the setting was to automatically logon to intranet site, it works fine.

But I do not want to have to set that for all my user's machines. There has GOT to be another way!!!

It must think that because you are using the DNS name, that you are on the internet, rather than inside the domain. It could be the same case for when you use an IP.

 

[mrdenny]

Yeah, I was just thinking that. You should be able to update that setting via a GPO. Or at the least you should be able to push out a reg key to all users.

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(Not quite so old any more.)