5

I have an intranet site using Windows Authentication. When users are prompted for credentials, they enter:

User: domain\username
Pass: SomePassword

It'd be nice if they could leave off the domain\ part which would be filled in with a default domain. I'm willing to give up the ability to login with a server/machine account (non-domain) because we don't use that anyway.

This seems to be possible with BasicAuth but I can't seem to find a reference for how to do it with WindowsAuth.

2 Answers 2

3

"Windows Authentication" means the browser send the credentials of the currently logged on user to the web server; then, if this authentication fails because the user doesn't have enough rights to access the site, he gets prompted for a logon.

The credentials sent automatically by Windows Authentication are always those of the currently logged on user, including the domain he belongs to; so you can't specify anything here, as it just wouldn't make any sense to do so.

9
  • So if the user is being prompted for credentials this suggests the site is falling back to Forms Auth? Commented Feb 15, 2010 at 15:14
  • When I open up IIS Manager and bring up Authentication for my site, it shows Windows Authentication (HTTP 401 Challenge) as the only enabled option. When I hit the site in Chrome I get a login box--that's what I want to set this for Commented Feb 15, 2010 at 15:16
  • Have you tried using just the username (not domain\username?). In my environment at least, logging on with just the username works from Firefox/Chrome/Safari (but not IE oddly enough).
    – MattB
    Commented Feb 15, 2010 at 15:24
  • @MattB: that doesn't work for me--I always must use the domain Commented Feb 15, 2010 at 15:27
  • @Michael Haren: Weird - is the user you are trying to login as in the same domain as the server?
    – MattB
    Commented Feb 15, 2010 at 16:15
2

You cannot, there is no way for IIS to set the default domain when using integrated authentication. A popular trick to appease users is to have them login with [email protected] (their UPN in Active Directory terms) instead - this typically matches their e-mail address, and is much more palatable to end users.

1
  • I thought it was a bad idea to use the same domain as used out on the WAN?
    – paradroid
    Commented Aug 15, 2010 at 6:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .