Auto log in with basic authentication

Auto log in with basic authentication

Secure Home | Search | About
 Microsoft Applications Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Auto log in with basic authentication ThatsIT.net.au 07-27-2007
Posted by ThatsIT.net.au on July 27, 2007, 11:07 am
If you were  Registered and logged in, you could reply and use other advanced thread options
I am currently setting up a intranet that will not be available from outside
the network, also a extranet that will be available from outside the
network.
The extranet has basic authentication and SSL. it passes though a ISA 2000
firewall and for various reasons we need to use basic authentication, but as
it is over SSL it is encrypted so it does not matter that basic uses clear
text.
Certain pages that need to be accessed from outside I will put on the
extranet but I don't want to have to recreate these pages on the intranet
also so internal users will access these pages from the extranet.
All seems fine but one point. when internal users access the extranet they
are prompted to log in, even though their browsers are set to log in
automatically with current username and password. this is annoying to say
the least.
Is there any solution?
Is this normal for basic over SSL to prompt even when set to auto login in
IE?
any suggestions



Posted by on July 27, 2007, 11:29 am
If you were  Registered and logged in, you could reply and use other advanced thread options
There is no workaround. The automatic login option in IE works with
integrated authentication only. This is because basic authentication
exposes the password (at both the network and application layers).
Prompting the user is meant as an additional security precaution to
address this exposure.

Can you enable both integrated and basic authentication on this
intranet site?

Regards,

J Wolfgang Goerlich

> I am currently setting up a intranet that will not be available from outside
> the network, also a extranet that will be available from outside the
> network.
> The extranet has basic authentication and SSL. it passes though a ISA 2000
> firewall and for various reasons we need to use basic authentication, but as
> it is over SSL it is encrypted so it does not matter that basic uses clear
> text.
> Certain pages that need to be accessed from outside I will put on the
> extranet but I don't want to have to recreate these pages on the intranet
> also so internal users will access these pages from the extranet.
> All seems fine but one point. when internal users access the extranet they
> are prompted to log in, even though their browsers are set to log in
> automatically with current username and password. this is annoying to say
> the least.
> Is there any solution?
> Is this normal for basic over SSL to prompt even when set to auto login in
> IE?
> any suggestions



Posted by ThatsIT.net.au on July 28, 2007, 12:29 am
If you were  Registered and logged in, you could reply and use other advanced thread options

> There is no workaround. The automatic login option in IE works with
> integrated authentication only. This is because basic authentication
> exposes the password (at both the network and application layers).
> Prompting the user is meant as an additional security precaution to
> address this exposure.
>
> Can you enable both integrated and basic authentication on this
> intranet site?
>


I think i did try that combination before, i will try again,

sorry just tried it seems to be working.


> Regards,
>
> J Wolfgang Goerlich
>
>> I am currently setting up a intranet that will not be available from
>> outside
>> the network, also a extranet that will be available from outside the
>> network.
>> The extranet has basic authentication and SSL. it passes though a ISA
>> 2000
>> firewall and for various reasons we need to use basic authentication, but
>> as
>> it is over SSL it is encrypted so it does not matter that basic uses
>> clear
>> text.
>> Certain pages that need to be accessed from outside I will put on the
>> extranet but I don't want to have to recreate these pages on the intranet
>> also so internal users will access these pages from the extranet.
>> All seems fine but one point. when internal users access the extranet
>> they
>> are prompted to log in, even though their browsers are set to log in
>> automatically with current username and password. this is annoying to say
>> the least.
>> Is there any solution?
>> Is this normal for basic over SSL to prompt even when set to auto login
>> in
>> IE?
>> any suggestions
>
>



Posted by ThatsIT.net.au on July 28, 2007, 1:16 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Actually I think I spoke too soon.

we have some laptops that need to connect though PC mobile phone cards. for
some reason I'm not sure they do not seem to want to connect to the web site
with intergraded security, I think this is what happened last time I choose
this configuration. I don't have one with me at the moment I would have to
wait till Monday to find out for sure.

This brings up another question. why wont the laptop's authenticate with
windows authentication when connecting with pc mobile phone cards?

>
>> There is no workaround. The automatic login option in IE works with
>> integrated authentication only. This is because basic authentication
>> exposes the password (at both the network and application layers).
>> Prompting the user is meant as an additional security precaution to
>> address this exposure.
>>
>> Can you enable both integrated and basic authentication on this
>> intranet site?
>>
>
>
> I think i did try that combination before, i will try again,
>
> sorry just tried it seems to be working.
>
>
>> Regards,
>>
>> J Wolfgang Goerlich
>>
>>> I am currently setting up a intranet that will not be available from
>>> outside
>>> the network, also a extranet that will be available from outside the
>>> network.
>>> The extranet has basic authentication and SSL. it passes though a ISA
>>> 2000
>>> firewall and for various reasons we need to use basic authentication,
>>> but as
>>> it is over SSL it is encrypted so it does not matter that basic uses
>>> clear
>>> text.
>>> Certain pages that need to be accessed from outside I will put on the
>>> extranet but I don't want to have to recreate these pages on the
>>> intranet
>>> also so internal users will access these pages from the extranet.
>>> All seems fine but one point. when internal users access the extranet
>>> they
>>> are prompted to log in, even though their browsers are set to log in
>>> automatically with current username and password. this is annoying to
>>> say
>>> the least.
>>> Is there any solution?
>>> Is this normal for basic over SSL to prompt even when set to auto login
>>> in
>>> IE?
>>> any suggestions
>>
>>
>
>



Posted by Roger Abell [MVP] on July 28, 2007, 2:12 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Remember that use of integrate authentication behind the scenes is
not just a matter of whether the website is configured to negotiate
its use. The browsing client (i.e. IE) must also be configured to
allow its use (in the Internet Options on the Advanced tab) and the
site must be recognized as one with which it will attempt is use
(usually that mean recognizing the site as being in the intranet
zone).

Roger


> Actually I think I spoke too soon.
>
> we have some laptops that need to connect though PC mobile phone cards.
> for some reason I'm not sure they do not seem to want to connect to the
> web site with intergraded security, I think this is what happened last
> time I choose this configuration. I don't have one with me at the moment I
> would have to wait till Monday to find out for sure.
>
> This brings up another question. why wont the laptop's authenticate with
> windows authentication when connecting with pc mobile phone cards?
>
>>
>>> There is no workaround. The automatic login option in IE works with
>>> integrated authentication only. This is because basic authentication
>>> exposes the password (at both the network and application layers).
>>> Prompting the user is meant as an additional security precaution to
>>> address this exposure.
>>>
>>> Can you enable both integrated and basic authentication on this
>>> intranet site?
>>>
>>
>>
>> I think i did try that combination before, i will try again,
>>
>> sorry just tried it seems to be working.
>>
>>
>>> Regards,
>>>
>>> J Wolfgang Goerlich
>>>
>>>> I am currently setting up a intranet that will not be available from
>>>> outside
>>>> the network, also a extranet that will be available from outside the
>>>> network.
>>>> The extranet has basic authentication and SSL. it passes though a ISA
>>>> 2000
>>>> firewall and for various reasons we need to use basic authentication,
>>>> but as
>>>> it is over SSL it is encrypted so it does not matter that basic uses
>>>> clear
>>>> text.
>>>> Certain pages that need to be accessed from outside I will put on the
>>>> extranet but I don't want to have to recreate these pages on the
>>>> intranet
>>>> also so internal users will access these pages from the extranet.
>>>> All seems fine but one point. when internal users access the extranet
>>>> they
>>>> are prompted to log in, even though their browsers are set to log in
>>>> automatically with current username and password. this is annoying to
>>>> say
>>>> the least.
>>>> Is there any solution?
>>>> Is this normal for basic over SSL to prompt even when set to auto login
>>>> in
>>>> IE?
>>>> any suggestions
>>>
>>>
>>
>>
>
>



Similar ThreadsPosted
Basic EFS Certificate Question April 12, 2006, 11:47 am
basic firewall rules July 26, 2006, 9:32 am
Basic question on SSL handshake March 2, 2007, 10:12 am
Very basic network security question November 17, 2005, 6:44 pm
Expired Certs (This MUST be basic question) June 25, 2007, 9:15 pm
auto complete February 6, 2006, 7:25 am
how to avoid auto sign in August 22, 2005, 12:31 pm
auto update baloon January 1, 2006, 7:11 pm
Auto Disable passwords? August 14, 2006, 6:30 pm
Auto downloads and installs -- ? March 9, 2008, 3:07 am

The site map in XML format XML site map

Contact Us | Privacy Policy