Welcome to ISAserver.org

Web Site prompting multiple login boxes

Users viewing this topic: none

Logged in as: Guest

Printable Version

All Forums >> [ISA Server 2000 General] >> General >> Web Site prompting multiple login boxes

Page: [1]

Message

<< Older Topic Newer Topic >>

Web Site prompting multiple login boxes - 10.Jul.2003 5:39:00 PM

ashimmons

Posts: 93
Joined: 18.Sep.2001
From: Belfast, N. Ireland
Status: offline

A user in my domain has access to a suppliers extranet. When they navigate to the domain.com they have to login. This is normal. What is not normal is the repeated login boxes.... when i dialup and bypass the ISA server i do not have this problem. The login looks like basic IIS authentication.

Anyone got any ideas?

Post #: 1

Featured Links*

RE: Web Site prompting multiple login boxes - 11.Jul.2003 12:05:00 PM

MatthewRoberts

Posts: 35
Joined: 8.Jul.2001
From: Fortville, IN USA
Status: offline

I would try the Firewall Client versus another method to see if the connection can be made. Also, what about disabling ISA Server caching for that particular site. -Matt

(in reply to ashimmons)

Post #: 2

RE: Web Site prompting multiple login boxes - 11.Jul.2003 12:28:00 PM

ashimmons

Posts: 93
Joined: 18.Sep.2001
From: Belfast, N. Ireland
Status: offline

I have tried the site on the ISA server itself. It runs as a securenat client with no client software installed. I have had a few issues with active caching before & since disabled that. Although i have not tried bypassing the cache for this site. I havent actually configured that for any site. How do you recommend configuring this? [Confused]

(in reply to ashimmons)

Post #: 3

RE: Web Site prompting multiple login boxes - 11.Jul.2003 10:53:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Aaron,

check out http://support.microsoft.com/default.aspx?scid=kb;en-us;297324 and see if it applies to your situation.

HTH,
Stefaan

(in reply to ashimmons)

Post #: 4

RE: Web Site prompting multiple login boxes - 12.Jul.2003 11:04:00 AM

ashimmons

Posts: 93
Joined: 18.Sep.2001
From: Belfast, N. Ireland
Status: offline

Hi Stefaan

The web site is a supplier extranet, i do not think it links to multiple domain, although i can not really tell. The ms article is similar only because of the multiple authentication boxes. For outgoing requests i use basic with domain/integrated & authenticate all unauthenicated. I do not have this particular site blocked to anyone & i have not configured a destination set.

Any ideas?

(in reply to ashimmons)

Post #: 5

RE: Web Site prompting multiple login boxes - 12.Jul.2003 1:36:00 PM

joeb1kenobe

Posts: 14
Joined: 22.Sep.2002
From: Dayton, OH USA
Status: offline

We had a simular problem where I work. A group of people only had access to a lighting distributer. But, their site had another domain doing a hits counter. I had to add the hits counter site into the destination set. It may be a simular situation in your case. The only way we found out, is to call the companies IT dept. and ask if their site links to other domains.

(in reply to ashimmons)

Post #: 6

RE: Web Site prompting multiple login boxes - 12.Jul.2003 11:04:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Aaron,

so all internal users have access to all external destinations without any limitation?

HTH,
Stefaan

(in reply to ashimmons)

Post #: 7

RE: Web Site prompting multiple login boxes - 12.Jul.2003 11:07:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Joe,

KB 297324 seems to fit your situation. Try it out and it should solve your problem. Just make sure ISA SP1 is installed and apply the registry change as described in the KB.

HTH,
Stefaan

(in reply to ashimmons)

Post #: 8

RE: Web Site prompting multiple login boxes - 13.Jul.2003 5:35:00 AM

AbqBill

Posts: 478
Joined: 3.Jun.2003
From: Albuquerque NM USA
Status: offline

I might also point out that, depending on your environment, a redirect to an internal web server (if possible) rather than a Deny may be preferable.

My reason is as follows: When I VPN into my office, the ISA Server at my office is configured via rules to require authentication (integrated only). My home machine is not a member of the domain at my office. When I VPN into the office and use the office's ISA Server, I get prompted for authentication (which is what I want). If I enable the ReturnDeniedIfAuthenticated setting, then I can't authenticate. At this point, I have not considered other authentication methods, so this works for me.

(in reply to ashimmons)

Post #: 9

RE: Web Site prompting multiple login boxes - 14.Jul.2003 9:38:00 AM

ashimmons

Posts: 93
Joined: 18.Sep.2001
From: Belfast, N. Ireland
Status: offline

Users have access to all sites, except those that have been blocked via destination site. They are redirected to an internal web server. Users only have access to HTTP/HTTPS content.

Users > Site & Content Rule (all destinations) limited content type
+
HTTP/HTTPS protocol rule.

I will try the KB article and post my findings.

(in reply to ashimmons)

Post #: 10

RE: Web Site prompting multiple login boxes - 14.Jul.2003 8:40:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Aaron,

OK! Let us know if it solves your problem. Just make sure ISA SP1 is installed and apply the registry change as described in the KB.

Thanks,
Stefaan

(in reply to ashimmons)

Post #: 11

RE: Web Site prompting multiple login boxes - 15.Jul.2003 9:23:00 AM

ashimmons

Posts: 93
Joined: 18.Sep.2001
From: Belfast, N. Ireland
Status: offline

Guys

This did not fix my problem. I already had sp1 installed, so i applied the reg edit then restarted the server. no luck.

I also contacted the supplier, as far as they know, the site does not link to any other domains or a hit counter!

I am now stuck. HELP!

[ July 15, 2003, 09:24 AM: Message edited by: Aaron Shimmons ]

(in reply to ashimmons)

Post #: 12

RE: Web Site prompting multiple login boxes - 15.Jul.2003 10:15:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Aaron,

have you all the recommended updates installed as described at http://www.microsoft.com/isaserver/downloads/default.asp (update 1 up to and including 6)?

Maybe it's time to take a Netmonitor Trace at the ISA internal interface or at the client to find out what exactly is happening.

HTH,
Stefaan

(in reply to ashimmons)

Post #: 13

RE: Web Site prompting multiple login boxes - 16.Jul.2003 9:49:00 AM

ashimmons

Posts: 93
Joined: 18.Sep.2001
From: Belfast, N. Ireland
Status: offline

Stefaan

I have installed sp1. What hot fixes do you recommend I apply? I have also captured the network traffic as i try to authenicate on the web site. But i am not sure what to look for. I can see the handshaking between my laptop & the ISA server and also the responses from the client web server.

[ July 16, 2003, 12:00 PM: Message edited by: Aaron Shimmons ]

(in reply to ashimmons)

Post #: 14

RE: Web Site prompting multiple login boxes - 16.Jul.2003 11:29:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Aaron,

I've reread the whole topic and I'm not sure we are on the right track! [Frown]

Let us try the following:

1) make sure ISA has all recommended updates as explained in http://www.microsoft.com/isaserver/downloads/default.asp .

2) Configure the suppliers extranet site for direct access, that means bypassing the web proxy service on ISA. How to do that is explained in http://www.isaserver.org/tutorials/Configuring_Web_Proxy_Clients_for_Direct_Access.html .

3) Be aware of some unexpected behaviour of the HTTP Redirector when set to Send to requested Web server. For more info, check out my article http://www.isaserver.org/tutorials/The_Mystery_of_the_HTTP_Redirector_and_SiteContent_Rules.html .

Once that's working, we can try to determine what is the cause of the login prompts: the web proxy service on ISA on his own or the suppliers extranet site in combination with the ISA web proxy service.

HTH,
Stefaan

(in reply to ashimmons)

Post #: 15

RE: Web Site prompting multiple login boxes - 17.Jul.2003 1:50:00 PM

ashimmons

Posts: 93
Joined: 18.Sep.2001
From: Belfast, N. Ireland
Status: offline

Hi Stefaan

I have applied 4 hot fixes that where not previously installed. I also tested the site using the bypass configuration. This was successful [Smile]

I then tried the site with out the proxy bypass. This also worked.

I tested the access on another pc. This pc was using Win2k sp3 IE5. This also worked. However the site will still prompts for multiple logins when using IE6.

I am happy enough to use my current setup and for the small amount of users I will rollback there browser version to IE5.

Do you have any idea why IE6 is not working? The login boxes are different. IE5 shows Site & Realm (info), Username & Password (text boxes). Where as IE6 shows Username, Password & domain (text boxes). Strange! [Confused]

Anyway... thanks for your help Stefaan... you have been a great help. You get my vote [Cool]

(in reply to ashimmons)

Post #: 16

RE: Web Site prompting multiple login boxes - 17.Jul.2003 11:20:00 PM

spouseele

Posts: 12782
Joined: 1.Jun.2001
From: Belgium
Status: offline

Hi Aaron,

first of all, thanks for the vote! [Smile]

Aha... only a problem with IE6. That rings a bell. I've heard of such problems but never encountered them myself. It is recommended *not* to request authentication on the outgoing Web Proxy listener but instead just request authentication on *all* your rules and to make sure you have no anonymous rules (those who applies to any request). Take note that a rule applying to a client address set is not considered as anonymous.

Another possibility is that the suppliers extranet site doesn't request basic authentication only but rather try to negotiate the 'highest' possible authentication level. That seems to create havoc with IE6 through a web proxy server. Maybe that explains why IE5 get a basic authentication prompt and IE6 an integrated authentication prompt. It is recommended that for maximum compatibility, the site should only ask for basic authentication.

HTH,
Stefaan

(in reply to ashimmons)

Post #: 17