Bit of a tricky one to explain in a title. I do not work in IIS very often at all, but because I have made changes to our DNS environment recently, it was decided this is my fault :)
We have a website hosted as the default site on a server, WEBSERV1.acme.local. This is a 2012 R2 server running IIS. Users will access the website through "CorpApp.acme.com" - i.e. with a .com address. There is also a "CorpApp.acme.local" address, but
no one seems to use that. The vendor that implemented the app used CNAME records on the test site, and A records on the production site, but with no other difference (we have a CorpApptest site that has exactly the same behaviour despite the different DNS
setups). The website is configured with passthru authentication, and until very recently it worked perfectly.
Perfectly that is, until I changed the DNS client that the workstations that connect to the website internally use. Instead of using a 2008 R2 DNS server to do the lookups, they now use a 2012 R2 server. Whenever users access the "CorpApp.acme.com" address,
they now receive a dialog box to enter their credentials. There is a box to enter your domain credentials - entering these will work, although saving the credentials doesn't (if you tick the "save my details" box, it will still prompt for credentials next
time you open the page).
And nothing else has changed. In fact, if I tinker with a workstation's DNS client settings, I can make it work when I use 2008 R2, but never 2012 R2. Switching between the two (I have to delete the IE cache to break it after changing from 2008 R2 to 2012
R2 as a DNS client) confirms this is the only difference. There are no issues with DNS or replication.
Anyone who uses the "CorpApp.acme.local" address will log in automatically without the dialog box appearing.
Since our Active Directory domain is "acme.local", I figured that the reason the credentials request appears is because it cannot find a domain controller for that domain. But the fact that it worked when the DNS client of the workstation is 2008 R2 and
doesn't for 2012 R2 - it confuses me - as if the 2012 R2 server returns a record in a way that makes the IIS server fail to recognise that the original source is a domain-joined PC - i.e. that it probably appears to come from the internet. The application
team has asked me to set up "CorpApp.acme.com" to be recognised as "intranet". I'm VERY wary to do this, because this exact same server receives requests through our reverse proxy for that address - I do not want internet traffic to be seen as intranet traffic!
So I'm wondering - what could possibly cause this? Pass through authentication works on the server - the server uses the 2012 R2 DNS server. The workstation clients used a 2008 R2 DNS server, and pass through works when accessing through "CorpApp.acme.com". Once that client server changes, the dialog box requesting credentials appears.
I'm a bit stumped! I was thinking of asking in the DNS forums, but this really sounds like the best place to start - it's possibly behaviour that someone has seen before?
