0

A few days ago I posted this question about a problem I was having accessing a web site hosted on one of our server. When I used HTTPS rather than HTTP I was being prompted for login credentials unexpectedly. As the accepted answer suggested, the problem was solved by adding the URL to my Intranet Zone in Internet Options, and I've since done some reading and discovered that if a URL contains periods (which ours does when we use HTTPS so as to match the SSL certificate), Windows assumes it belongs to the Internet Zone (and therefore prevents automatic Windows authentication) even if it's part of the same domain as the client computer. By adding the URL manually to the Intranet Zone, automatic authentication works as expected.

So, this all works fine with one exception. The fix does not work on the web server hosting the website. I've added the web server's URL to the Intranet Zone on the web server but it continues to prompt me for credentials when I try to access a web page on that server. I've tested the same configuration on another server and found the same issue. It seems that adding a sever to the Intranet Zone has no effect when you browse to a website hosted on that server from a browser on the same machine.

This is a problem for us because I need a web site on the server to call a web service hosted on the same server, and at the moment it fails due to the authentication issue. I could HTTP rather than HTTPS, which works (because I can just use the hostname without the domain - no periods), but I'm not comfortable with that as the data is sensitive and I'm not completely sure that the traffic isn't being routed over the network, even though both the website and the web service are on the same box. I'm not a DNS expert by any means.

Has anybody else encountered this issue whereby Intranet Zone settings are seemingly ignored on the server when browsing to sites hosted on itself? Is there any way to fix this?

5
  • Sounds like a Kerberos/spn issue. Running as a service domain user? Mar 6, 2018 at 12:39
  • For now I'm just trying to access the URL in a web browser on the web server, logged on with my own domain credentials. That works on client machines, but I get prompted for login credentials on the web server itself. Mar 6, 2018 at 12:47
  • What user is IIS APP Pool running as. Mar 6, 2018 at 15:12
  • @JacobEvans It's running as ApplicationPoolIdentity. Mar 7, 2018 at 9:07
  • Change it to a dedicated domain service account, and setup Kerberos spn authentication. Mar 7, 2018 at 23:11

2 Answers 2

1

I think you may need to disable local loopback authentication check as described here https://support.microsoft.com/en-us/help/896861/you-receive-error-401-1-when-you-browse-a-web-site-that-uses-integrate

1
  • I really thought this was it, it seems to describe our problem very well, but I've followed those steps (I tried Method 1 and Method 2) and it hasn't made any difference. Mar 7, 2018 at 9:19
-1

Are you using the server FQDN when you're browsing to it locally? You might be missing the SPN for the bare NetBIOS name of the server, if that's what you're using. I assume you're not using https://localhost.

If both the FQDN and short-name SPNs are there, try adding the site to Trusted Sites.

1
  • I am, I'm using exactly the same FQDN locally as I am from a client machine. I'm afraid the "SPN for the bare NetBIOS name" part is a bit over my head! I've tried adding the FQDN to the Trusted Sites zone on the server but I'm still prompted for login credentials. Mar 6, 2018 at 12:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .