0

I've exhausted every bit of me to get Windows Authentication to work on the server and I cannot find any help on the internet. Windows authentication is working on my local PC, below is what I've done so far, kindly assist me understand if there's something I am missing or did wrong?

  1. Windows Server 2012 R2 (v6.2) with IIS (v8.5.9600)
  2. Here's how my web.config looks like:

    <system.web> <httpRuntime targetFramework="4.5" maxRequestLength="1048576" /> <compilation debug="true" targetFramework="4.5" /> <authentication mode="Windows"/> <authorization> <deny users="?"/> <allow users="*"/> </authorization> </system.web>

  3. And here's the authentication section in IIS:

enter image description here

  1. I've added the website as a Trusted Site (also as a Local Intranet) in Internet Explorer and that didn't help:

enter image description here

  1. Many threads (including this one here) advised I add 2 entries to the registry to:
    • Set the DisableStrictNameChecking registry entry to 1
    • and add my website url in: BackConnectionHostNames

I've done so as per below and still no luck, I've even gone as far as performing the above steps on both the server and my local PC as well:

enter image description here enter image description here

  1. And I've mirrored everything else on there as is on my local PC. The server was restarted after doing the above 2 steps. The website is configured to use pass-through authentication in IIS and works fine on my local PC:

enter image description here

Is there something I am missing or not doing right? I've carried this problem into my New Year and I am so tired of it. Please anyone help me or point me in the right direction.

5
  • You need to specify what you mean by "not working". What occurs?
    – Greg Askew
    Mar 26, 2020 at 11:31
  • @GregAskew, I keep getting a login prompt asking for username and password. If I click cancel then I get 401.1 Unauthorized.
    – Morgs
    Mar 26, 2020 at 13:06
  • Are the server and the client part of the same AD domain? An active trust relationship is required for the credentials to be passed. Mar 26, 2020 at 14:57
  • @RowanHawkins, the part that is not working is to authenticate using Windows Authentication. The system does not even get the point where I can connect to the AD server
    – Morgs
    Mar 28, 2020 at 13:51
  • 1
    The fact that you didn't answer the question tells me that they are probably not in the same domain and as a result no matter what settings you tweak you will not be able to authenticate with Windows credentials. There is no trust relationship between the systems and that is required for the systems to pass Windows credentials and authenticate them. Windows credentials in the aspect of IIS means AD verification, not login/pass. Mar 28, 2020 at 21:11

1 Answer 1

0

Your credentials in the www authorization header are not accepted by the server. You should confirm if the account you are logged on the system where you are connecting from has permission to authenticate to the site.

Additionally:

https://support.microsoft.com/en-us/help/264921/how-iis-authenticates-browser-clients

  • If Windows Integrated is the only supported method (or if Anonymous fails), then the browser must support this method to communicate with the server. If this fails, the server does not try any of the other methods.

  • If Basic is the only supported method (or if Anonymous fails), then a dialog box appears in the to get the credentials, and then passes these to the server. It attempts to send the credentials up to three times. If these all fail, the browser does not connect to the server.

  • If both Basic and Windows Integrated are supported, the browser determines which method is used. If the browser supports Kerberos or Windows NT Challenge/Response, it uses this method. It does not fall back to Basic. If Windows NT Challenge/Response and Kerberos are not supported, the browser uses Basic, Digest, or Fortezza if it supports these. The order of precedence here is Basic, Digest, and then Fortezza.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .