locked
basic authentication, default domain, & IE RRS feed

  • Question

  • Hi all,

    This has been asked over the years, but from my searching, never really answered fully

    From my testing, it seems like IE insists on appending the local workstation to all basic authentication requests that do not include a domain.  This then invalidates the "Default Domain" setting within IIS for that particular website, causing authentication to fail.  Other browsers don't do this, and the default domain setting works fine.

    Test scenario:  Computer not joined to the domain hits a basic authentication website.  Authentication prompt reads  "Username:  Password:   and text on bottom reads Domain:  WORKSTATIONNAME" .  User supplies only username and password.  Server logs an attempt to authenticate to a domain identical to the workstation name, and fails.

    There's no way around this, correct?   Default domain specification just doesn't work with IE & Basic Authentication?

    Thanks for your help.

    Monday, April 6, 2015 3:20 PM

All replies

  • Hello GrandmasterPhil,

    Do you mean that only Internet Explorer have the pop up about the web authentication?

    Please try to reset the Internet Explorer and check if the issue still exists.
    http://support.microsoft.com/en-us/kb/923737

    If this issue occur on all Internet Explorer in the domain, please check if the website is compatible with Internet Explorer.

    Best regards,
    Fangzhou CHEN


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Thursday, April 9, 2015 2:11 AM
  • Hello GrandmasterPhil,

    Do you mean that only Internet Explorer have the pop up about the web authentication?

    Please try to reset the Internet Explorer and check if the issue still exists.
    http://support.microsoft.com/en-us/kb/923737

    If this issue occur on all Internet Explorer in the domain, please check if the website is compatible with Internet Explorer.

    Best regards,
    Fangzhou CHEN


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    I am talking about basic authentication behavior in IE, and the setting of the "Default Domain" property within IIS, which is not being respected by the browser.  Unlike other browsers, IE appears to always submit a domain when authenticating, which breaks the default domain functionality.  It affects all Internet Explorers.
    Saturday, April 11, 2015 6:13 PM
  • IE has security settings preventing navigation into zones of lower integrity.

    Make sure both domains map to the same IE security zone. (or remove them so that they both default to the internet zone).

    Tools>Internet Options>Security tab, click "Reset all zones to default"

    ... make sure you are accepting your company's default security zone settings.

    File>Properties to determine which IE security zone a web page maps to on the client.

    F12>Networking tab, click the start button to start recording the browser requests and the server responses.

    look for redirects.

    Regards.


    Rob^_^

    • Proposed as answer by FangZhou Chen Tuesday, April 14, 2015 1:43 AM
    • Marked as answer by Karen Hu Monday, April 27, 2015 9:07 AM
    • Unmarked as answer by GrandmasterPhil Tuesday, May 12, 2015 3:32 AM
    Monday, April 13, 2015 1:54 AM
  • IE has security settings preventing navigation into zones of lower integrity.

    Make sure both domains map to the same IE security zone. (or remove them so that they both default to the internet zone).

    Tools>Internet Options>Security tab, click "Reset all zones to default"

    ... make sure you are accepting your company's default security zone settings.

    File>Properties to determine which IE security zone a web page maps to on the client.

    F12>Networking tab, click the start button to start recording the browser requests and the server responses.

    look for redirects.

    Regards.


    Rob^_^

    Not sure how Rob's answer got marked as an "Answer".  I appreciate his input, but it has nothing to do with this issue.  This is a single domain; single URL; no-redirect scenario that involves authentication.  I am looking for anyone who can indicate that specifying a default domain on a directory utilizing basic authentication will work in IE.


    EDIT:  I'll add that Rob was probably confused by my usage of "Default Domain".  I am not talking about a website domain.  Rather, I am talking about the ability to specify an active directory authentication domain on the IIS web directory.
    Tuesday, May 12, 2015 3:31 AM