Professional Web Applications Themes

IIS and FQDN authentication confusion - ASP.NET Security

Hi, ENV: Windows 2003 Server SP1, IIS6, .Net 1.1 I'd like to know why the authentication and delegation differs when accessing a web site using the Fully Qualified Domain Name as opposed to 'localhost'. We have an ASP.Net application which has only 'Integrated authentication' enabled on the virtual directory. The ASP.Net application access a remote resource on behalf of the authenticated user. The authentication and impersonation modes are: <authentication mode="Windows" /> <identity impersonate="true" /> I test this with 3 authentication scenarios (IE running on the IIS server in every one). 1) I connect to the app using http://localhost/MyApp, everything is ...

  1. #1

    Default IIS and FQDN authentication confusion

    Hi,

    ENV: Windows 2003 Server SP1, IIS6, .Net 1.1

    I'd like to know why the authentication and delegation differs when
    accessing a web site using the Fully Qualified Domain Name as opposed to
    'localhost'.

    We have an ASP.Net application which has only 'Integrated authentication'
    enabled on the virtual directory. The ASP.Net application access a remote
    resource on behalf of the authenticated user.

    The authentication and impersonation modes are:
    <authentication mode="Windows" />
    <identity impersonate="true" />

    I test this with 3 authentication scenarios (IE running on the IIS server in
    every one).

    1) I connect to the app using http://localhost/MyApp, everything is fine and
    the remote resource is accessible.

    2) I specify the FQDN - http://mybox.domain.local/MyApp and I am prompted
    for credentials. Now, I know that this is because IE thinks I am outside
    the intranet zone - fair enough. The thing I don't understand is that
    although my credentials are accepted, subsequent access to the remote
    resource is denied ('Access denied' error).

    3) So I thought - OK, must be something to do with basic authentication
    then. So I reconfigured the Virtual directory to have only 'Basic
    Authentication' expecting the same result. I was surprised at the outcome -
    using either localhost or the FQDN worked. The web app could access the
    remote resource on my behalf.

    My question is - what is the difference between scenario 2 and 3?

    I am thinking that in scenario 2, IE is failing back to 'Basic
    Authentication'? If that is the case, then scenario 3 should not work
    either.

    So, is scenario 2 actually 'Basic authentication', but not allowing
    delegation because it thinks I am not on the Intranet?!!

    I'd appreciate
    <authentication mode="Windows" />

    <identity impersonate="true" />

    Thanks,
    Stuart


    NB. To reproduce - the simple scenario is two servers:

    Web Server - ASP.Net app reading a file off of a share on the file
    server.
    File Server


    Stu Guest

  2. #2

    Default Re: IIS and FQDN authentication confusion

    It sounds like you might not be getting Kerberos authentication to the web
    server when you use the FQDN, and thus delegation is not working. You might
    check the security logs (assuming logon audits are enabled) and verify
    whether Kerberos or NTLM is used.

    Using a packet sniffer like ethereal and also a tool like Wfetch (IIS 6
    resource kit) can also help troubleshoot this stuff.

    If that is the issue, it is possible that you might be missing a needed SPN
    for the web server that matches the FQDN which results in no TGT request
    being generated on the client end.

    HTH,

    Joe K.

    "Stu Carter" <nospam> wrote in message
    news:phx.gbl... 


    Joe Guest

  3. #3

    Default Re: IIS and FQDN authentication confusion

    Hello Joe,

    if you connect from localhost it always works - because technically it is
    not a delegation - they just pass the token locally - so it is a single hop
    only.

    for the rest i can only agree.


    ---------------------------------------
    Dominick Baier - DevelopMentor
    http://www.leastprivilege.com
     [/ref]


    Dominick Guest

  4. #4

    Default Re: IIS and FQDN authentication confusion

    Doh, that is right! Thanks, I was so concentrating on the Kerb
    troubleshooting (that I just did for hours last week) that I forgot that
    case. :)

    He may not even have delegation enabled yet.

    Joe K.

    "Dominick Baier [DevelopMentor]" <com>
    wrote in message news:microsoft.com... [/ref]
    >
    >[/ref]


    Joe Guest

  5. #5

    Default Re: IIS and FQDN authentication confusion

    Hi,

    In addition to the comments from Joe and Dominick, and to answer your
    questions about the differences in your scenarios:

    Scenario 2 does not work because the site is not in the Intranet zone. By
    default IE will *not* attempt Kerberos authentication for sites in the
    Internet zone, and all websites with FQDN are in the Internet zone unless
    you add them to the Intranet zone. Unless you add the site to the Intranet
    zone -or- start accessing the site using a NetBIOS style name, IE will use
    NTLM auth which is not delegatable. There is no "fall back" mechanism. IE
    will see the various WWW-Authenticate headers (Negotiate, NTLM and Basic),
    and choose the first one (i.e. the strongest one) on the list. This will be
    NTLM (even if you only specify Negotiate, this allows IE to choose NTLM over
    Kerberos). So there is no "fallback" to Basic auth.

    Scenario 3 works because IIS has the user's username/password in clear text
    and can directly logon as that user.

    Cheers
    Ken


    "Joe Kaplan (MVP - ADSI)" <accenture.com> wrote
    in message news:%phx.gbl...
    : It sounds like you might not be getting Kerberos authentication to the web
    : server when you use the FQDN, and thus delegation is not working. You
    might
    : check the security logs (assuming logon audits are enabled) and verify
    : whether Kerberos or NTLM is used.
    :
    : Using a packet sniffer like ethereal and also a tool like Wfetch (IIS 6
    : resource kit) can also help troubleshoot this stuff.
    :
    : If that is the issue, it is possible that you might be missing a needed
    SPN
    : for the web server that matches the FQDN which results in no TGT request
    : being generated on the client end.
    :
    : HTH,
    :
    : Joe K.
    :
    : "Stu Carter" <nospam> wrote in message
    : news:phx.gbl...
    : > Hi,
    : >
    : > ENV: Windows 2003 Server SP1, IIS6, .Net 1.1
    : >
    : > I'd like to know why the authentication and delegation differs when
    : > accessing a web site using the Fully Qualified Domain Name as opposed to
    : > 'localhost'.
    : >
    : > We have an ASP.Net application which has only 'Integrated
    authentication'
    : > enabled on the virtual directory. The ASP.Net application access a
    remote
    : > resource on behalf of the authenticated user.
    : >
    : > The authentication and impersonation modes are:
    : > <authentication mode="Windows" />
    : > <identity impersonate="true" />
    : >
    : > I test this with 3 authentication scenarios (IE running on the IIS
    server
    : > in every one).
    : >
    : > 1) I connect to the app using http://localhost/MyApp, everything is fine
    : > and the remote resource is accessible.
    : >
    : > 2) I specify the FQDN - http://mybox.domain.local/MyApp and I am
    prompted
    : > for credentials. Now, I know that this is because IE thinks I am
    outside
    : > the intranet zone - fair enough. The thing I don't understand is that
    : > although my credentials are accepted, subsequent access to the remote
    : > resource is denied ('Access denied' error).
    : >
    : > 3) So I thought - OK, must be something to do with basic authentication
    : > then. So I reconfigured the Virtual directory to have only 'Basic
    : > Authentication' expecting the same result. I was surprised at the
    : > outcome - using either localhost or the FQDN worked. The web app could
    : > access the remote resource on my behalf.
    : >
    : > My question is - what is the difference between scenario 2 and 3?
    : >
    : > I am thinking that in scenario 2, IE is failing back to 'Basic
    : > Authentication'? If that is the case, then scenario 3 should not work
    : > either.
    : >
    : > So, is scenario 2 actually 'Basic authentication', but not allowing
    : > delegation because it thinks I am not on the Intranet?!!
    : >
    : > I'd appreciate
    : > <authentication mode="Windows" />
    : >
    : > <identity impersonate="true" />
    : >
    : > Thanks,
    : > Stuart
    : >
    : >
    : > NB. To reproduce - the simple scenario is two servers:
    : >
    : > Web Server - ASP.Net app reading a file off of a share on the file
    : > server.
    : > File Server
    : >
    :
    :


    Ken Guest

  6. #6

    Default Re: IIS and FQDN authentication confusion

    Thanks very much everyone, that makes it clear.

    Cheers,
    Stu

    "Ken Schaefer" <com> wrote in message
    news:phx.gbl... 


    Stu Guest

  7. #7

    Default Re: IIS and FQDN authentication confusion

    You're right, we haven't configured delegation, so we can only do one hop.

    "Joe Kaplan (MVP - ADSI)" <accenture.com> wrote
    in message news:phx.gbl... 
    >>
    >>[/ref]
    >
    >[/ref]


    Stu Guest

Similar Threads

  1. Replies: 3
    Last Post: September 16th, 06:30 PM
  2. Replies: 2
    Last Post: July 19th, 10:15 PM
  3. emf confusion
    By Steve Russell in forum Macromedia Freehand
    Replies: 2
    Last Post: May 13th, 10:17 AM
  4. FQDN for Home System?
    By Larry Lindstrom in forum Sun Solaris
    Replies: 1
    Last Post: August 2nd, 02:32 AM
  5. CD/RW Confusion?
    By Bill R in forum Windows XP/2000/ME
    Replies: 6
    Last Post: July 8th, 06:26 PM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139