Windows authentication of Intranet ASP.NET website and reappearing windows login box

Question

I'm trying to enable automatic Window authentication working on our ASP.NET Intranet. I've changed the Authentication on our IIS 7.5 server from Anonymous to Windows Authentication Enabled only, and changed the Web.config file for the website to:

<authentication mode="Windows" />
 <authorization>
    <deny users="?" />
 </authorization>

The Windows login box appears when accessing the website via IE 8, I enter valid credentials, but the login window keeps reappearing as if it does not accept my credentials. By repeatedly cancelling the login box it disappears, and my login name can be viewed on the website. Is there any possible reason for the login box to keep popping up even though valid credentials are being entered? I've restarted the servers / cleared browser cache etc.

Also, ideally I would like the user to enter the login details once in the login box and not be required to reenter login details whenever he reopens the browser.

Answer 1

Check if your browser has "Enable Integrated Windows Authentication" checked. In IE it's in the Advanced options.

Answer 2

You should be able to configure it so you don't have to see the login prompt at all. IIS seems to be configured correctly since it's asking you for credentials. So I would test out the browser settings. Some things I would check for are that:

1. Make sure that your browser recognizes the site as being in your Intranet. You should see the "Intranet" zone icon near the right side of your status bar.
2. If not, you should add it to your list of local sites.
3. Check that your credentials are being passed to sites in the local intranet.
4. Make sure your links are all consistent, for example if you use a different DNS name or access by IP, the browser won't necessarily know they belong to the same site and try to reauthenticate.

Something else that might be going on is if you're trying access resources that you're account isn't allowed to. So make sure that isn't happening. I'm wondering since you said hitting cancel gets your page to show the login name.