Re: Is NTLM Authentication very expensive? (for bandwidth)

From: x y (jamescagney90210@excite.com)
Date: 05/15/02 

From: "x y" <jamescagney90210@excite.com>
Date: Wed, 15 May 2002 07:03:28 -0400

"Rick Dekker" <rick.dekker@bankofbermuda.com> wrote in message
news:3a9001c1fbfb$6c787040$3aef2ecf@TKMSFTNGXA09...
> Hi,
>
> We've got SQL Digital Dashboard 3.0 setup, with anonymous
> access disabled on the site properties and NTFS
> permissions and just using Integrated Authentication
> (NTLM). Our clients are in the same domain as the server.
>
> Due to slow reponse time of DD from our overseas locations
> i ran Network Monitor and noticed that i received a lot
> more data then the actual size of the dashboard.
>
> Running through the IIS Logs I saw that my browser goes to
> the server twice every time, once as anymous and once as
> NTLM. Now i know that this is by design. It always does
> anonymous first. But, why does it cost me about 3827 bytes
> for every request to do the NTLM (challenge/response)
> authentication? ALso shouldn't it cache this
> authentication information? At the bottom of this msg is
> an excerpt from the IIS log, with a single client (IE6)
> who's logged into our production domain and loading up the
> main page of the Digital Dashboard, you can see it always
> tries anonymous first, gets a 401 back and then uses NTLM.
> You can also see that at every first anonymous request the
> server sends 3827 bytes to the client.
>
> Because of this my browser received in total 256Kb more
> data, because there are in total 57 failed anymous HTTP
> GET requests, each sending around 3827 bytes to the
> client. This looks very expensive to me.
>
> Is this by design? Or is there something going wrong here.

I think this is working as expected. Since http is stateless and is
reauthenticated with each new page request, I would be surprised if the web
browser caches the anonymous authentication failure. To test it or to
improve performance, you could set up a new virtual folder or site for the
remote WAN sites that points to the same directories and files but where
either anonymous access is disabled, or integrated authentication is
disabled. If performance is still slow with only integrated authentication
enabled, then maybe you need a local domain controller/global catalog or
caching DNS server to improve windows authentication performance. I'm not
really sure why it would ever make sense to enable both anonymous and
windows integrated authentication, since it gives no security and less than
comprehensive logging of user browsing.

Relevant Pages

  • Re: Problems with RWW and WSUS
    ... Tried to access http://<servername>/remote and http:///exchange from the server and my PC - still get HTTP 404 errors. ... Make sure that all sites are stopped and and check again the ASP.net tab on the Default web site to be set to 1.1.4322. ... Default -, ASP.NET version 2.0.50727, 127.0.0.1 and 192.168.16.0/24 granted access, Anonymous and Integrated Authentication checked ... Sharepoint Central Administration -, ASP.NET version 2.0.50727, all granted access, Integrated Authentication only method checked ...
    (microsoft.public.windows.server.sbs)
  • Re: IIS6, Integrated Windows Auth, and IE6 Integrated Windows Auth
    ... on your server, modifying its behavior, and causing the issue. ... do you feel that there is an issue with NTLM ... > application -- after IIS has successfully authenticated with NTLM -- so it ... > is an application issue and not with IIS6, Integrated Authentication, nor ...
    (microsoft.public.inetserver.iis)
  • Re: Problems with RWW and WSUS
    ... I would also suggest you restart the server. ... Been chasing my tail the last week or so trying to get WSS, company web and WSUS to all work at the same time. ... -Remote, ASP.NET version 1.1.4322, access the same, Anonymous and Integrated Authentication checked ... Sharepoint Central Administration -, ASP.NET version 2.0.50727, all granted access, Integrated Authentication only method checked ...
    (microsoft.public.windows.server.sbs)
  • Re: Problems with RWW and WSUS
    ... SBS BPA identifies the .net framework on the default site as 2.0 instead of 1.1. ... You should have two entries for port 80: Default with host header the name of your server, and 127.0.0.1 with no host header. ... -Remote, ASP.NET version 1.1.4322, access the same, Anonymous and Integrated Authentication checked ... Sharepoint Central Administration -, ASP.NET version 2.0.50727, all granted access, Integrated Authentication only method checked ...
    (microsoft.public.windows.server.sbs)
  • Re: Problems with RWW and WSUS
    ... In IIS Manager, start by setting the IP address of the Default Web Site ... Server Usage Report is not viewable; I get "Server Error in '/Monitoring' ... in HTTP 404 errors. ... and Integrated Authentication checked ...
    (microsoft.public.windows.server.sbs)
Loading