Re: Problem establishing SSL connection in code-behind

Integrated Windows Authentication is the term in IIS used to mean Windows
Negotiate authentication over HTTP (usually). Negotiate authentication is a
protocol in Windows as of Win2K that "negotiates" between Kerberos
(preferred) and NTLM (down level compatibility). It is possible to
configure IIS to only advertise for NTLM, but the default is for it to
request Negotiate when IWA is selected.

You can see exactly what your server is requesting if you do the GET in
Wfetch with anonymous auth selected and then look at the content of the
WWW-Authenticate header returned in the 401 response from the server. If it
says "Negotiate" with some other Base64 gibberish, then you know it is using
the default.

Wfetch allows you to be more granular with which protocol will actually be
used, which is helpful for some troubleshooting.

It is possible that there is a problem with Kerberos auth and not NTLM,
which might cause you to see a 401 when Negotiate is attempted instead of
NTLM. Normally, there will be an error from Kerberos in the event log from
the web server and should also be a logon failure audit in the security
event log. Wfetch will sometimes return an error code as well that can be
helpful.

A common reason why you might get a Kerberos error is if the app pool
identity in IIS is running under an account other than Network Service or
System but you are using the default machine name for the host name in your
URI and the SPN in AD is still associated with the machine account. That
will usually result in a KERB_APP_ERR_MODIFIED error. If that is the
problem, there are a number of ways to fix it.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--

OK, thank you. Are you suggesting that NTLM is different from
Integrated Windows Authentication? (The remote web site uses
Integrated Windows Authentication). I thought they are the same, NTLM
is only an old terminology.

I did try using Negotiate, and the result is different: It gives an
401 unauthorized message, and the hola, amigo webpage is not shown.


.

Relevant Pages

  • v6 windows Update Error 0x80072EEF
    ... The WinXP and Win2003 server machines update progerly using the same isa ... <Negotiate (NTLM or Kerberos);> ...
    (microsoft.public.windowsupdate)
  • Re: Windows Auth -- double hop issue??
    ... But we are not talking about Kerberos, ... but I think that Integrated Windows authentication does ... resource on the same machine using NTLM, ... disabled in IIS, and HTTP request does not leave machine boundaries, ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Windows Auth -- double hop issue??
    ... But we are not talking about Kerberos, ... but I think that Integrated Windows authentication does ... resource on the same machine using NTLM, ... disabled in IIS, and HTTP request does not leave machine boundaries, ...
    (microsoft.public.dotnet.security)
  • Re: Windows Auth -- double hop issue??
    ... But we are not talking about Kerberos, ... but I think that Integrated Windows authentication does ... resource on the same machine using NTLM, ... disabled in IIS, and HTTP request does not leave machine boundaries, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: Active Directory Web-Based Password Reset
    ... Not really sure what you are referring to by "password reset". ... >- IIS uses NTLM ... >Haven't had the time to investigate, so a simpler version follows using NTLM. ... >IIS with SSL, NTLM (Integrated Windows Authentication) ...
    (Security-Basics)
Quantcast