IIS7 Kerberos/NTLM authentication problem

[Oaktech]

We've got our intranet site running on IIS7, we have authentication enabled so that only staff can see the staff page and students, the students page. Our primary school site, which is a seperate domain, with a trust, which runs over a wireless link, has been added appropriately to the permissions of the sites, but the loading performance at the primary site is very very poor. It takes minutes to load the pages. We've tried doing the ntlm non auth persist thing, which i think has made a small difference, but it's very little difference.

 

Help!

[jinnantonnixx]

NTLM is not an efficient protocol. For every single object retrieved, you'll see a deny, a challenge and an authentication response in your logs if you have full logging enabled. I've had a world of hurt getting Kerberos and NTLM working through Squid on Linux, but I digress.

 

Kerberos is a much more effiecient protocol, network wise.

 

For troubleshooting, get the 'Firebug' extension loaded up into Firefox on your clients and see what this says. I'm quite sure it will narrow down the problem.

[Oaktech]

Thanks...

 

We've tried that, removing the kernel mode auth, then selecting negotiate - kerberos, in the security means it prompts for username and password, so not quite what we had in mind... we are trying to fix that now :S

[jinnantonnixx]

Thanks...

 

We've tried that, removing the kernel mode auth, then selecting negotiate - kerberos, in the security means it prompts for username and password, so not quite what we had in mind... we are trying to fix that now :S

 

Close the browser, kill existing Kerberos tickets with the command klist purge, then retry the browser.