Mapped DNS hostname to intranet, now asks for user/pass?

[dgsmith]

Our internet home page points to the intranet server and has always just used the actual server name, however I have wanted to move to a more consistent setup using our main domain name (thus setting an internal DNS mapping to intranet.ourdomain.com).

 

Quite bizarrely, for half the school (mixed students, staff) this asks for a username/password to the actual web server (popup challenge box) whereas the other half it loads up the index.php as expected. For those who get the user/pass challenge, they can manually browse to the intranet by going direct to the server without issue.

 

Any reason why this would be happening? In IIS 7.5 (Win Svr 2k8 R2) we use Windows authentication (as there are a few things that we need this for, such as determining whether they're staff or student and auto login to mrbs etc); if we enable anon auth then it causes other issues.

 

Is this something simple that needs changing?

[diagdave]

If you are using kerberos the spn for the service account might be wrong. In the authentication page there is a providers page. Move ntlm to above negotiate and this will force ntlm first.

[dgsmith]

ah yes, I remember something about this.. sure I had done it but when checked it does seem NTLM was 2nd best, so to speak! Will see what that does next week.. thanks for reminding me about that

[glennda]

You might need to add it as a trusted sitealso- If windows suspects the site is external it will not pass creds through as far as I know (otherwise anybody could try and request your creds

[Dooms_Dave]

Check what zone IE thinks its in, as said above if it says internet zone then NTLM auth wont work. When I had this issue I added them to the intranet zone, I don't think trusted sites worked for me as IE still saw it as a (trusted) external. Cached profiles might also cause you a few issues (well they did for me but that could just be CC4)

[dgsmith]

Seems to have sorted it now, thanks!