5

I have an intranet site using Windows Authentication. When users are prompted for credentials, they enter:

User: domain\username
Pass: SomePassword

It'd be nice if they could leave off the domain\ part which would be filled in with a default domain. I'm willing to give up the ability to login with a server/machine account (non-domain) because we don't use that anyway.

This seems to be possible with BasicAuth but I can't seem to find a reference for how to do it with WindowsAuth.

2 Answers 2

3

"Windows Authentication" means the browser send the credentials of the currently logged on user to the web server; then, if this authentication fails because the user doesn't have enough rights to access the site, he gets prompted for a logon.

The credentials sent automatically by Windows Authentication are always those of the currently logged on user, including the domain he belongs to; so you can't specify anything here, as it just wouldn't make any sense to do so.

9
  • So if the user is being prompted for credentials this suggests the site is falling back to Forms Auth? Feb 15, 2010 at 15:14
  • When I open up IIS Manager and bring up Authentication for my site, it shows Windows Authentication (HTTP 401 Challenge) as the only enabled option. When I hit the site in Chrome I get a login box--that's what I want to set this for Feb 15, 2010 at 15:16
  • Have you tried using just the username (not domain\username?). In my environment at least, logging on with just the username works from Firefox/Chrome/Safari (but not IE oddly enough).
    – MattB
    Feb 15, 2010 at 15:24
  • @MattB: that doesn't work for me--I always must use the domain Feb 15, 2010 at 15:27
  • @Michael Haren: Weird - is the user you are trying to login as in the same domain as the server?
    – MattB
    Feb 15, 2010 at 16:15
2

You cannot, there is no way for IIS to set the default domain when using integrated authentication. A popular trick to appease users is to have them login with username@domain.com (their UPN in Active Directory terms) instead - this typically matches their e-mail address, and is much more palatable to end users.

1
  • I thought it was a bad idea to use the same domain as used out on the WAN?
    – paradroid
    Aug 15, 2010 at 6:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.