Intranet access off domain requires authentication

[dgsmith]

As most, we run an internal intranet server which is accessed by all as the home page. This only works fine for users connected, and accessing via their domain account login (domain networked clients).

 

Some staff use standalone laptops and in these cases we map network drives, printers etc manually but when they try and access our intranet site it asks them for a username/password (from the intranet server, not their domain one).

 

Anyone any idea why this is or how we'd resolve it?

[SYNACK]

It depends on if your intranet is static or requires logon to grab stuff lipe helpdesk/email status on the main page. If not just enable annonymous authentication on the site and set your file permissions so that the IIS_USR account has read perms or just give the everyone group read perms to the intranet files themselves.

[dgsmith]

Something so simple, something so effective, thanks

[dgsmith]

Or not..

 

Seems that enabled anon auth throws back 500 errors to domain users on authentation-based areas of the intranet.

 

For example, we use MRBS and when I enabled anon auth the intranet worked except for this, which when loading gave a 500 access error. I disabled anon auth again and it worked..

 

Not sure how to get around that??

[SYNACK]

For areas that require auth, they'll need auth. Just disable annon for those folders in IIS and it will prompt for only those areas that need it. Edited November 22, 2011 by SYNACK

[dgsmith]

Ok, so disabled anon auth for the specific folders that require a more local-level, however in the case of MRBS, with anon auth disabled, it again works fine for domain users but for standalone/non-domain access, it pops up a server credentials box (obviously the users cannot auth directly with the intranet server) and because of this, it prevents access to actually getting to the MRBS area.

 

Still rather confused!

[SYNACK]

Users need to logon to get to domain resources otherwise it defeats the purpose of user tracking and authentication for stuff like helpdesks. They should still be able to logon by using yourdomain\username as the username.

 

you can also set the default domain for some types of authentication How to configure IIS Web site authentication in Windows Server 2003

 

I think basic does this but it does send the password in cleartext which is not overly safe.