Auto log in with basic authentication

[ThatsIT.net.au]

I am currently setting up a intranet that will not be available from outside
the network, also a extranet that will be available from outside the
network.
The extranet has basic authentication and SSL. it passes though a ISA 2000
firewall and for various reasons we need to use basic authentication, but as
it is over SSL it is encrypted so it does not matter that basic uses clear
text.
Certain pages that need to be accessed from outside I will put on the
extranet but I don't want to have to recreate these pages on the intranet
also so internal users will access these pages from the extranet.
All seems fine but one point. when internal users access the extranet they
are prompted to log in, even though their browsers are set to log in
automatically with current username and password. this is annoying to say
the least.
Is there any solution?
Is this normal for basic over SSL to prompt even when set to auto login in
IE?
any suggestions

 

[jwgoerlich]

There is no workaround. The automatic login option in IE works with
integrated authentication only. This is because basic authentication
exposes the password (at both the network and application layers).
Prompting the user is meant as an additional security precaution to
address this exposure.

Can you enable both integrated and basic authentication on this
intranet site?

Regards,

J Wolfgang Goerlich

 

[Scott McDaniel]

In addition to microsoft.public.inetserver.iis.security and microsoft.public.security, you've posted this message to the
"microsoft.public.access" newsgroup, which is devoted to security matters involving Microsoft Access, the database
product.The name of this group is somewhat misleading, however this group has nothing to do with the other two (which
are, apparently, relevant to your issue).

I am currently setting up a intranet that will not be available from outside
the network, also a extranet that will be available from outside the
network.
The extranet has basic authentication and SSL. it passes though a ISA 2000
firewall and for various reasons we need to use basic authentication, but as
it is over SSL it is encrypted so it does not matter that basic uses clear
text.
Certain pages that need to be accessed from outside I will put on the
extranet but I don't want to have to recreate these pages on the intranet
also so internal users will access these pages from the extranet.
All seems fine but one point. when internal users access the extranet they
are prompted to log in, even though their browsers are set to log in
automatically with current username and password. this is annoying to say
the least.
Is there any solution?
Is this normal for basic over SSL to prompt even when set to auto login in
IE?
any suggestions

Scott McDaniel
scott@takemeout_infotrakker.com
www.infotrakker.com

 

[ThatsIT.net.au]

In addition to microsoft.public.inetserver.iis.security and
microsoft.public.security, you've posted this message to the
"microsoft.public.access" newsgroup, which is devoted to security matters
involving Microsoft Access, the database
product.The name of this group is somewhat misleading, however this group
has nothing to do with the other two (which
are, apparently, relevant to your issue).


Sorry



Scott McDaniel
scott@takemeout_infotrakker.com
www.infotrakker.com