Windows 11 & Pass through Authentication

[Guest ZFarnworth]

Hello all.

 

Wanting to know if anyone who’s using windows 11 on their domain and also uses pass through authentication has seen that it won’t authenticate you due to internet explorer not being a thing anymore in windows 11.

 

Wanting to know if you’ve notified this too?

 

Ta.

 

Zak

[Oaktech]

It should still work via Edge, but you might need to look at your intranet zones list...

 

"Windows Integrated Authentication (WIA)

Microsoft Edge also supports Windows Integrated Authentication for authentication requests within an organization's internal network for any application that uses a browser for its authentication. This is supported on all versions of Windows 10 and down-level Windows. By default, Microsoft Edge uses the intranet zone as an allow-list for WIA. Alternatively, you can customize the list of servers that are enabled for Integrated Authentication by using the AuthServerAllowlist policy. On macOS, this policy is required to enable Integrated Authentication.

 

To support WIA-based SSO on Microsoft Edge (version 77 and later), you might also have to do some server-side configuration. You will probably have to configure the Active Directory Federation Services (AD FS) property WiaSupportedUserAgents to add support for the new Microsoft Edge user agent string. For instructions on how to do this, see View WIASupportedUserAgent settings and Change WIASupportedUserAgent settings. An example of the Microsoft Edge user agent string on Windows 10 is shown below, and you can learn more about the Microsoft Edge UA string here.

 

The following example of a UA string is for the latest Dev Channel build when this article was published:

"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3951.0 Safari/537.36 Edg/80.0.334.2"

 

For services that require delegating Negotiate credentials, Microsoft Edge supports Constrained Delegation using the AuthNegotiateDelegateAllowlist policy."

[Guest ZFarnworth]

It should still work via Edge, but you might need to look at your intranet zones list...

 

"Windows Integrated Authentication (WIA)

Microsoft Edge also supports Windows Integrated Authentication for authentication requests within an organization's internal network for any application that uses a browser for its authentication. This is supported on all versions of Windows 10 and down-level Windows. By default, Microsoft Edge uses the intranet zone as an allow-list for WIA. Alternatively, you can customize the list of servers that are enabled for Integrated Authentication by using the AuthServerAllowlist policy. On macOS, this policy is required to enable Integrated Authentication.

 

To support WIA-based SSO on Microsoft Edge (version 77 and later), you might also have to do some server-side configuration. You will probably have to configure the Active Directory Federation Services (AD FS) property WiaSupportedUserAgents to add support for the new Microsoft Edge user agent string. For instructions on how to do this, see View WIASupportedUserAgent settings and Change WIASupportedUserAgent settings. An example of the Microsoft Edge user agent string on Windows 10 is shown below, and you can learn more about the Microsoft Edge UA string here.

 

The following example of a UA string is for the latest Dev Channel build when this article was published:

"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3951.0 Safari/537.36 Edg/80.0.334.2"

 

For services that require delegating Negotiate credentials, Microsoft Edge supports Constrained Delegation using the AuthNegotiateDelegateAllowlist policy."

 

Thanks for your reply, I did try this and no luck unfortunately but we decided to make the move to okta for federation and we’ve added out local active directory to be the main directory and just sync users and passwords up to okta and so far works like a charm.

[Guest ZFarnworth]

Please ignore my previous reply: Had to go back to adfs as problems with password change back to local ad wouldn’t work so adfs is now back in action and will try what you have said again.

 

 

Thanks