Windows Forum

Ask something
Discussion Locked

Web page authentication problem

0 helpful
4 replies

by scottorgan

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am using Win2K to host a company web page. I have added a subfolder off of the root of the website that I have setup to require a login using basic authentication. This seems to work fine using any domain users name and passowrd... However, when that user tries to go from the secure page back to a unsecure page on our site, it ask again for a username and password. The only way to get back to the non secure page is to enter the same username, and leave the password blank. Any ideas on how I can get rid of this second login prompt?

4 replies

by shanghai sam

Okay, I think I managed to reproduce these symptoms. This is running on IIS 5. The setup is as follows. I made website called clear that had anonymous access enabled and nothing else. I added a folder inside of wwwroot that did not allow anonymous access. Now as far as I can tell it is the browser that is causing the problem. I am using IE 5.5. To reproduce the symptoms, I had to set the security settings on the Internet Zone ( this is the zone I put the clear and the password protected site in). In IE you go to Tools | Options | Security Tab | Internet Zone | Custom Level | User Authentication and I set User Authentication to Prompt for User name and password.

Now, when I first go to the clear site it lets me straight in. I then go tothe password protected site and log in with a domain user name and password that has read permissions to the protected files. I now follow a link back to the clear site and it prompts me for a username and password. If I enter a domain account, it fails. If I clear the boxes and send an empty username and password, it lets me in. This seems to reproduce your situation.

(((((((((continued in next block to meet the 1930 char limit )))))))))))

by shanghai sam

((((((continuation of above ))))))))))

My understanding of this is that as you browse web sites IE will pass the credentials of the most recently logged in username as you access sites. If you have not had to log into a site yet then IE will sendan empty username and IIS will attempt to use Anonymous access to display the page. This continues to work fine until we go the protected site. When you submit the GET request for the protect file, IE passes the empty credentials and IIS attempts anonymous access. When this fails, you are prompted for an account. You then enter the domain account and are granted access. Now you go back to the unprotected area. When IE issues the GET request for the unprotected page it passes the most recent credential with it, the domain account. Since the domain account does not have explicit rights to view the page, you get a login dialog. If we return an empty login attempt, IIS interprets this as an attempt to use anonymous login and returns the unprotected page via anonymous login.

The solution here is to change the security settings to something else. Specifically depends on what Zone you have your sites in. Just play with the User Authentication setting. You could also grant read permissions to Authenticated Users and Anonymous on the unprotected site. So when there name gets passed in it will be accepted.

Sheeeeew! I hope this helps. If not, let us know.

by scottorgan

Well, I am not sure how I fixed it, but this gave me enoguh insight to get it working corectly. Thanks.

This discussion is closed to new replies.