I have been tasked with trying to troubleshoot an issue with accessing an in house website (published on IIS 7.5) from another domain. The site is published in domainB on IIS 7.5 running in Windows 2008 Server. It is configured to allow basic and windows authentication, everything else disabled. Basic auth has domain and realm set accordingly to "domainB". Windows auth has "enhanced protection" as off. Now, internally ie for a person logged in to a machine on domainB, the URL can be accessed fine, ie, Windows auth is working ok. For someone logged in to a machine locally, they get prompted just once for credentials, and if these credentials are correct, the website is displayed fine. No proxy is in use internally within domainB.
Now, there is a another domain, domainA, which is external to domainB. In between them is an ISA 2006 server located in domainA acting as forward proxy only with appropriate access policy set in the firewall policy. Internet Explorer in domainA has the appropriate proxy server name set. However, when trying to access the URL in this case, we are prompted once for a credentials, but then again prompted, and again and again, until the webpage has finished downloaded. I don't know much about ISA myself but someone on the web tech team has simply told me that it is configured as forward proxy, not as reverse proxy and hence no web listener.
As a test, I left only "basis authentication" enable on IIS - this time results different. We get prompted once in domainB, and also only once in domainA when accessing URL. The prompt is also different, with a little message clearly stating password will be sent in clear text. So question is, why will it not work in domainA properly with both windows and basic auth enabled? I thought IIS would fail back to basic if windows auth did not work?
↧