ASP.NET Windows Authentication Not Working/Not Accepting Credentials

Question

I've been trying to resolve this question for a couple weeks now via Google and reading SO, and not had much luck, so I thought I'd finally try asking myself.

I'm setting up a very, very simple ASP.NET site on our intranet to generate some information for internal users. I'm using Windows authentication, rather than anonymous access, because based on what user hits the site I will be generating different information.

Long story short, this works perfectly in testing on my local Windows 7 machine where I developed the application. However, from the Windows 2008 R2 server where I want it to reside, when I hit the site I get a pop-up asking for my credentials, and even if I enter them it asks me for them again and again. This happens regardless if I'm hitting the site remotely or locally. If I try using anonymous access I can reach the site both ways but as I cannot identify the user I cannot generate the information I would like to provide.

Notes:

1. In IIS, I have Windows Authentication and ASP.NET Impersonation enabled for the site. Everything else is disabled.

2. For the sake of figuring it out, I currently have the web.config set to allow all users and am not denying any.

3. The host/URL I'm using for it is toolName.organization.local
   
4. I was concerned that it was an issue of the 2008 R2 server admin user residing in a different domain then my remote user that I was testing with but again it does not work locally either.
   

5. In the AppHost file, I currently have windowsAuthentication enabled.

               <windowsAuthentication enabled="true">
               <providers>
                   <add value="Negotiate" />
                   <add value="NTLM" />
               </providers>
               </windowsAuthentication>
   

Admittedly, I typically use forms authentication on this server for all of our other internal sites so I'm a bit new to windows authentication and this issue. At this point I'm just not sure what to try or check next, so any advice would be helpful. Thanks.

Answer 1

I know this is a slightly old topic, but I had this exact same problem. Turns out I had the AppPool using Identity: ApplicationPoolIdentity instead of NetworkService. Once I switched that (under Advanced Settings in IIS7.5) I no longer got the server prompting for additional credentials and the pass-through worked perfectly.

Hope that helps!

Answer 2

First, you should realize that Windows passthrough authentication only works with Internet Explorer, and then only if the site is in the trusted sites, or intranet sites security group. Firefox, Chrome, etc.. will always prompt for credentials.

Having said that, you have a couple of issues.

You should have an <authentication mode="Windows" /> element in your web.config

You should decide if you want the app to run in the context of the user, in which case you would also need an <identity impersonate="true"/> tag. If not it should be false (although this is the default).

You do not need to have any authorization rules in your web.config if the site itself is completely guarded by windows authentication.

Answer 3

Just in case it's helpful, the problem for me was that I had left my application pool in Classic mode, in order to try to use NTFS permissions. I never got that to work, but once I switched it back to Integrated mode, I could use <allow> and <deny> tags to configure specific users' access.