quote:

ORIGINAL: Jason Jones

When an Office application opens, it creates a new session as opposed to riding on the back of IE. Subsequently, ISA will ask for authentication as the session is new. This an age old ISA publishing problem when using SharePoint and document libraries.

There is now a way to solve it in ISA2k6 by using HTML form authentication with persistant cookies which allow applictions outside the broswer to use cookies (e.g. office apps). HOWEVER, the cookies are "persistent" e.g. they do not get deleted when you close the browser or office apps so could potentially be accessed and/or brute forced if left in an Internet cafe or public location. The cookies timeouts still apply though, so they will expire based upon timeout configuration in ISA, which isn't quite so bad.

There is an option for "use persistent cookies only on private computers" which goes someway to combat this as the users have to choose "private computer" in the FBA form in order to activate the persistent cookie feature. Hence only users that really need the streamlined Office docs approach can choose private and all others will be fine accessing other sharepoint data with the public computer option. Obviously, users should only use private computer when using machines they trust e.g. not in an Internet cafe!

Hope this helps...

JJ