ASP.NET / Active Directory - Supporting auto login for domain users

Question

I am developing a simple ASP.NET website that will run on the intranet on a WS2008(IIS7) box and respond to users running XP/IE8. Everything is domain connected and I am trying to automatically login the users much like SharePoint does.

On my dev machine (XP), when running the site through VS, everything works. I can pickup on the user perfectly. I am using the following settings:

<authentication mode="Windows"/>
<identity impersonate="true"/>
<anonymousIdentification enabled="false"/>

<authorization>
    <allow users="*"/>
    <deny users="?"/>
</authorization>

However, when I publish to the WS2008 box, it doesn't work. Clearly I am missing a setting in IIS7 to support this.

I have the following set for Authentication on the site:

Anon Auth - Enabled
ASP.NET Impersonation - Enabled
Basic Auth - Disabled
Forms Auth - Disabled
Windows Auth - Disabled

What am I missing? Thanks

Answer 1

Try disabling anonymous login from the iis. Go to the security options for the site on IIS and uncheck the Enable Anonymous login. Make sure that windows authentication is checked.

Edit:: If the login box appears when trying to login with IE, there is a setting that you can set so that IE sends the username when used in the intranet sites. Go to tools > internet options > security and in the security settings select the option Automatic Logon with current username and password or Automatic Logon only in intranet Zone You have to make sure that the site you are trying to use is added in the intranet zone.

There is a similar setting with firefox and chrome I believe but I am not sure how to set it up

Answer 2

You need to enable "Windows Authentication" in IIS and disable "Anon Auth"

Here are the settings, you should be using:

Anon Auth - Disabled

ASP.NET Impersonation - Enabled

Basic Auth - Disabled

Forms Auth - Disabled

Windows Auth - Enabled

Answer 3

Consider also the intranet zone settings for the browser, as well as the security settings. Try adding other flavors/variations of the URL to the intranet sites zone in IE. My understanding is this is how IE determines if it should automatically submit credentials instead of prompting.