Single Sign On Issue

Question

Hello,

I have enabled the auto logon option and provided I use http://localhost/AdaxesAdmin things are fine, but if I use the FQDN of the server or 127.0.0.1 then I get a kerberos prompt and then Access is Denied and the SignIn.aspx screen. I can then login with if I put in username and password.

I have checked the web.config and computer delegation settings, but in IIS I noticed the error "Challenge-based and login redirect-based authentication cannot be used simultaneously". If I disable the Forms Authentication this error goes away, but it still doesn't work.

Thank you in advance for any help.

Answer 1

Hello,

I have checked the web.config and computer delegation settings, but in IIS I noticed the error "Challenge-based and login redirect-based authentication cannot be used simultaneously". If I disable the Forms Authentication this error goes away, but it still doesn't work.

Please ignore the error and enable the Forms Authentication.

The reason for your issue is that your browser is not configured for Single Sign-On. For information on how to configure your browser, see Single Sign-On Browser Configuration.

Comments

I know that, but why doesn't it work with the browser login box?

Ultimately I am accessing Adaxes via a reverse-proxy that does the authentication for me and then passes the credentials on via Kerberos/NTLM, but that isn't working yet.

If I access the web site from a browser without the configuration I get a popup for username/password, but then get the Access Denied and the forms. I suspect if that was working by proxy would work also.

---

The fact that the browser dialog box appears means that the browser is not using Kerberos, and the NTLM authentication mechanism is used instead. NTLM authentication is not supported. If you configure your browser for Single Sign-On per the instructions above, you will actually enable it to use Kerberos for Adaxes Web interface instead of NTLM.

So, if your reverse proxy supports passing credentials using Kerberos, we don't see any issues, this should work.

---

Ok, thanks. The proxy is using Kerberos Constrained Delegation and I can see in the IIS logs the username in the requests, however I am still redirected to the SignIn form. Perhaps what I am attempting is not going to work....

---

We didn't test Adaxes Web Interface with web proxies, however the Web Interface uses the standard built-in IIS mechanism for Windows Authentication. Any documentation that you will find for enabling and configuring IIS Windows Authentication with your reverse proxy will be applicable to Adaxes Web interface.

---

Further confusion based on your reply....

If I add the FQDN of the web interface server into Trusted Sites Zone, but leave the Logon option set to "Automatic Logon only in Intranet Zone", then I get the browser popup for username/password and can log in as any user which is what I want.

If I set the Logon option to "Automatic logon with current user name and password" it logs me on as the user I am logged into Windows as (as you would expect).

If I remove the FQDN from Trusted Sites Zone, the popup username/password appears, but I then get the "Access is denied" and the Sign In page....

Thanks

---

It looks like the computer where Adaxes Web interface is installed is not treated by your browser as the intranet zone. In this case, Kerberos cannot be used, and the browser tries to authenticate using NTLM.

When you add the computer to the Trusted Sites Zone, a request to perform Kerberos handshake is received from the Web Interface, and your browser prompts for credentials to be used for Kerberos authentication.

When you enable the Automatic logon with current user name and password option, the browser tries to login via Kerberos with the current Windows session credentials.