Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If client is accessing file on windows server through http (not https) and authenticates using Integrated Windows Authentication in browser, how securely is the password sent?

Is it sent in plaintext or not?

share|improve this question
add comment

1 Answer

up vote 5 down vote accepted

Using Integrated Security the password is not sent across the network at all making it a far better choice than Basic or Digest. There are some caveats that you need to know about, such as browser support, external authentication, delegation, etc.

Have a look at this article for a description of what happens with Integrated Security and things to keep in mind. Look at Integrated Security in the Authentication Methods section.

From the article:

Integrated Windows authentication (using either NTLM challenge/response or Kerberos) involves authenticating a user with a Windows NT Domain or Active Directory account. Unlike Basic and Digest authentication, the encrypted password is not sent across the network, which makes this method very secure. If Active Directory Services is installed on the server and the browser is compatible with the Kerberos V5 authentication protocol, both the Kerberos V5 protocol and the challenge/response protocol are used; otherwise only the challenge/response protocol is used. It is best suited for an intranet environment, where both user and Web server computers are in the same domain and where administrators can ensure that every computer is running Microsoft Internet Explorer version 3.01 or later.

share|improve this answer
    
"You should not consider Integrated Windows authentication when: (...) - You need to support authentication over the Internet." ....that is exactly what I am doing..... does that mean I shouldn't, or does it only mean that the article is too outdated? –  Karel Bílek Aug 4 '10 at 18:39
2  
That means that it doesn't work. You need to have an Active Directory infrastructure in place in order to have Integrated security. Your best option over the Internet is Basic over HTTPS. –  squillman Aug 4 '10 at 19:06
    
Oh, OK, thanks. In that case, I am probably using something different. –  Karel Bílek Aug 4 '10 at 20:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.