none
SharePoint prompting for password when saving word document

    Question

  • Saving a word document back to SharePoint always prompts for credentials.

    I am the administrator for a SharePoint farm. We have enabled kerberos, and added the portal to the intranet zone in Internet Explorer by group policy. Most of the time this limits the amount of password prompts our customers see (including viewing the portal in a browser, and opening documents); however, we are still getting the prompt for credentials when trying to save a word document back to SharePoint.

    Here are some details: - SharePoint 2010 - Word 2010 - Kerberos enabled - Portal added to intranet zone in IE - Checkbox for passing automatic credentials enabled

    Can anyone help? Is there something I've missed? Is this prompt just unavoidable?

    Friday, November 16, 2012 5:46 PM

Answers

  • Hi,

    Internet Explorer uses the Web Client service when you use Internet Explorer to access a WebDAV resource. The Web Client Service uses Windows HTTP Services (WinHTTP) to perform the network I/O to the remote host.  WinHTTP sends user credentials only in response to requests that occur on a local intranet site.  However, WinHTTP does not check the security zone settings in Internet Explorer to determine whether a Web site is in a zone that lets credentials be sent automatically.

    1. Click Start, type regedit in the Start Search box, and then press ENTER.
    2. Locate and then click the following registry subkey:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters
    3. On the Edit menu, point to New, and then click Multi-String Value.
    4. Type AuthForwardServerList, and then press ENTER.
    5. On the Edit menu, click Modify.
    6. In the Value data box, type the URL of the server that hosts the Web share, and then click OK.

      Note   You can also type a list of URLs in the Value data box. For more information, see the "Sample URL list" section in this article.
    7. Exit Registry Editor.

    After this registry entry is created, the WebClient service will read the entry value. If the client computer tries to access a URL that matches any of the expressions in the list,   the user credential will be sent successfully to authenticate the user, even if no proxy is configured.

    Note You have to  restart the WebClient service after you modify the registry.

    Reference: http://support.microsoft.com/kb/943280?wa=wsignin1.0

    -Ivan


    Ivan Sanders My LinkedIn Profile, My Blog, @iasanders.

    • Marked as answer by cawkell Monday, November 19, 2012 6:16 PM
    Sunday, November 18, 2012 4:54 PM

All replies

  • Hi,

    Internet Explorer uses the Web Client service when you use Internet Explorer to access a WebDAV resource. The Web Client Service uses Windows HTTP Services (WinHTTP) to perform the network I/O to the remote host.  WinHTTP sends user credentials only in response to requests that occur on a local intranet site.  However, WinHTTP does not check the security zone settings in Internet Explorer to determine whether a Web site is in a zone that lets credentials be sent automatically.

    1. Click Start, type regedit in the Start Search box, and then press ENTER.
    2. Locate and then click the following registry subkey:
      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient\Parameters
    3. On the Edit menu, point to New, and then click Multi-String Value.
    4. Type AuthForwardServerList, and then press ENTER.
    5. On the Edit menu, click Modify.
    6. In the Value data box, type the URL of the server that hosts the Web share, and then click OK.

      Note   You can also type a list of URLs in the Value data box. For more information, see the "Sample URL list" section in this article.
    7. Exit Registry Editor.

    After this registry entry is created, the WebClient service will read the entry value. If the client computer tries to access a URL that matches any of the expressions in the list,   the user credential will be sent successfully to authenticate the user, even if no proxy is configured.

    Note You have to  restart the WebClient service after you modify the registry.

    Reference: http://support.microsoft.com/kb/943280?wa=wsignin1.0

    -Ivan


    Ivan Sanders My LinkedIn Profile, My Blog, @iasanders.

    • Marked as answer by cawkell Monday, November 19, 2012 6:16 PM
    Sunday, November 18, 2012 4:54 PM
  • Thank you very much Ivan! That worked perfectly and you gave a great description. I really appreciate it!
    Monday, November 19, 2012 6:17 PM
  • In the Microsoft document, it says:

    • Do not add an asterisk (*) character at the end of a URL. When you do this, a security risk may result.
      http://*.dns.live.*

    What if we want everything beyond the front page to also be use automatic credentials?

    So if in the registry, if I put https://blahblah.server.com -- is it only going to allow auto logon for the root page?  And if I want it to auto logon for any site on the server, do I need to specify https://blahblah.server.com.* ?

    Tuesday, October 01, 2013 3:07 PM
  • Hi,

    When you enter the wildcard before the domain http://*.live.com it will pass your logged in authentication through to everything in the domain. This restricts passing your userid and password to all pages / sub domains etc in the domain listed, which is what you want...

    -Ivan


    Ivan Sanders <a href="http://www.linkedin.com/in/iasanders">My LinkedIn </a> , <a href="http://msmvps.com/blogs/ivansanders">My Blog</a>, <a href="http://twitter.com/iasanders"> @iasanders</a>, <a href="http://shop.oreilly.com/product/0790145372703.do">BI in SP2013</a>, <a href="http://sharepointdemobuilds.codeplex.com">SP2013 Content Packs</a>.

    Tuesday, October 01, 2013 9:09 PM
  • Here is a quick and easy video on fixing one of the common causes of multiple password prompts in SharePoint. It is especially prevalent if the remember password checkbox never seems to do anything. It details modifying IE settings.

    http://www.youtube.com/watch?v=HHHyCGdjP2A

    Hope this helps!


    Check out my latest blog posts on www.supertekboy.com A tech blog for I.T. Superheroes.

    Sunday, January 12, 2014 3:11 PM
  • hi Ivan,

    we have the same problem but doesnt work with your desciption, do you have an idea? When usern saving the Word document prompting the password in our sharepoint 2013?

    BR

    Ümit

    Wednesday, July 29, 2015 10:30 AM
  • Check my link above. Have you tried adding the SharePoint site to the Local Intranet site in Internet Explorer? 

    <a href="http://www.supertekboy.com">Check out my latest blog posts on www.supertekboy.com</a> A tech blog for I.T. Superheroes.

    Wednesday, July 29, 2015 12:50 PM
  • hi Gareth,

    i will test this and come back to you, thanks in advanced...

    BR

    ümit 

    Thursday, July 30, 2015 7:05 AM