Re: Accessing network file form ASP page

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 03/08/05


Date: Mon, 7 Mar 2005 19:07:10 -0800

I believe IE has some hardcoded behavior that treats names differently
depending on whether it has dots or not. The thing that changed is probably
its authentication/auto-logon behavior.

As to how it affects usage of Integrated Authentication -- maybe IE has code
in it that thinks "Integrated Authentication should not work over the
Internet" (because it usually does not). Sorry, dunno much more about IE
other than superficial observations of IE behavior from the outside.

-- 
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Lamberti Fabrizio" <lambu@from_italy.it> wrote in message
news:uIo69i0IFHA.2752@TK2MSFTNGP12.phx.gbl...
when I use url WITH domain specification IE loads it inside Internet
Security Zone, while when I use url WITHOUT domain specification it's loaded
inside Intranet Security Zone.
So I've tried adding the host with domain specification inside Trusted Sites
Security Zone and now my asp page works properly.
I've found the solution but I can't understand the reason, or better, I
couldn't found which option inside Security Option panel has solved my
problem.
Any idea ?
"David Wang [Msft]" <someone@online.microsoft.com> wrote in message
news:u6tiRE0IFHA.2356@TK2MSFTNGP12.phx.gbl...
> This is most likely a browser-side issue.  For example, IE authenticates
> differently depending on whether the server name has dots in it or not (it
> treats it as different zones).
>
> IIS does not alter behavior based on server name (unless you configured
host
> header and DNS incorrectly or have server-side application that alters
> behavior based on SERVER_NAME server variable). It is just another
> identifier as far as IIS is concerned.
>
> -- 
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no
rights.
> //
> "Lamberti Fabrizio" <lambu@from_italy.it> wrote in message
> news:%23PlrJ$vIFHA.2420@TK2MSFTNGP14.phx.gbl...
> your suggestion is correct but now I've got this strange problem.
>
> When I use my asp page (try.asp) to access the text file by this url
> http://IIS_WebServerName/try.asp, it is all right, but when I use this url
> http://IIS_WebServerName.DomainName.Ext/try.asp , I obtain the usual
error:
> my asp page can't access the text file.
>
> Can you still help me?
>
>
> "David Wang [Msft]" <someone@online.microsoft.com> wrote in message
> news:%236ashMvIFHA.1528@TK2MSFTNGP09.phx.gbl...
> > > The authentication inside asp file is made only with domain user. By
> > > this domain users I can manually access to tha text file, but my web
> > > server can not.
> >
> > This is the classic "double hop" scenario.  Integrated
> Authentication(NTLM)
> > does not support "double hop" because the web server is not authorized
to
> do
> > so.
> >
> > Authentication choices that allow double hop include:
> > 1. Basic
> > 2. Integrated Authentication(Kerberos)
> > 3. Custom Authentication that mimics #1 or #2 in principle
> > 4. Protocol Transition from (Whatever)->Kerberos
> >
> > The following URL should have the necessary pointers to set this up. It
> > talks about things in terms of a UNC vdir, but it is really not much
> > different than an ASP page accessing a UNC share.
> >
> >
>
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/webapp/iis/remstorg.mspx
> >
> > I believe IIS5 supports choices #1, #2, and #3.
> >
>
>
>
>


Relevant Pages

  • Re: IIS/Windows Permissions/Rights
    ... double hop because that is a security vulnerability. ... Suppose your ASP page, when authenticated, connects to the user's bank using ... allowing the server to use their identity on their behalf to do something. ... Kerberos between IIS6 and the backend servers -- the authentication protocol ...
    (microsoft.public.inetserver.iis.security)
  • Re: NT security accounts database vs. "other"
    ... > drawbacks as I see it to NT authentication are that it may require you to ... > domain than just web server access. ... > Another option is to use local Windows accounts on the web server. ... > on an ASP page for authentication. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Kerberos machine authentication - apparent authentication fail
    ... > until logon), the wireless connection can kick off when it is ready. ... > was confirmed in the server event logs with IAS (i set that up as the radius ... > as an ordinary user kicks in and takes over from the machine authentication. ... > while the network sorts itself out and a double click on a network link of ...
    (microsoft.public.windows.server.security)
  • Re: Basic Authentication + IIS 5 + Windows 2000 + Frontpage 2002 = failure?
    ... SYSTEM account. ... In IIS I took the virtual server that I was testing, ... Authentication premise. ... From a website perspective, I ...
    (microsoft.public.inetserver.iis.security)
  • Need help configuring Wireless Connection profile
    ... I have an SBS 2003 server and a Server 2003 member server set up using RADIUS ... Windows authentication for all users,4129,LRG\ryanv,4149,Wireless WPA2 PEAP ... Certificate Services ...
    (microsoft.public.windowsxp.general)