IE/IIS integrated authentication problem

Question

In IIS I've got:

http://myserver/myapplication
http://myserver/reports

The reports app is reporting services in fact which uses windows authentication. myapplication is an asp.net application that uses forms authentication.

The server is outside the company domain. If I access the reports first and type in the user and password(local credentials created on the server) when prompted I can access the reports page, no problems. If then I go straight to my application's login page and try to login, the login page refreshes without doing anything. This always happen in IE 6. In IE 7 it happens intermittently. Does not happen in Firefox or if Fiddler is running in the background which seems to fix the problem on the fly.

I used wireshark to see what's going on and found that IE 6 send the windows authentication token obtained from the reports app to myapp. That was the only difference between IE and Firefox. IIS seems to freak out and simply interpret my POST to the login page as a GET and return.

If I add windows authentication to myapplication in IIS everything seems to work fine with any browser.

Why is this happening? A bug in IE or am I missing something?

Answer 1

It's sorta a bug in IE, and sorta a bug in the design of NTLM/Negotiate (aka Integrated) authentication over HTTP.

NTLM/Negotiate are connection-oriented auth protocols, which HTTP wasn't really designed for. As a result, when you require this auth mechanism for one page on your server, IE will typically assume that other pages on the server have the same requirement.

Furthermore, for performance and security reasons, if IE expects a Negotiate/NTLM challenge for a given POST request, then it will first send a 0 byte POST, expecting the server to return a HTTP/401 challenge to which it will authenticate and then properly send the POST body.

However, in your case, the folder which doesn't require Integrated auth gets the 0 byte POST and says "Hrm, weird, a 0 byte post. Okay, HTTP/200, here's the page as if you'd used GET."

Because IE never gets the 401 challenge it expects, it never actually sends the POST body.

(Fiddler may confuse you a bit due to how HTTP connection reuse works).

The workaround is to ensure that if you're using Integrated auth on the host, use it everywhere.