1

I have an issue where when streaming office documents from SQL Server, an authentication dialog prompts for credentials even though the user has been authenticated via basic auth in the browser. Clicking cancel on the auth dialog still allows the document to open properly.

The goal is to prevent the auth dialog from displaying. The Web Server sits in our DMZ and the SQL Server box sits internal to the organization. In Active Directory in our Dev environment I have been able to change the web server delegation to kerberos (trust this computer to any servers) and the auth dialog goes away. My concern is whether this is the right approach from a security perspective. What is the right and most secure way to prevent the auth dialog, whatever approach will need to be justified with our operations team.

Here are the response header and code currently being applied (in C#), potentially office documents may have additional requirements that I have not configured correctly. 

     byte[] b = rda.Attachment;
     Response.ClearContent();
     Response.ClearHeaders();
     Response.AppendHeader("Content-Disposition", "filename=" + rda.UploadedFilename);
     Response.ContentType = mime;
     Response.BinaryWrite(b);
     Response.End();
     return File(b, mime);

Any thoughts would be helpful.

EdenRockStar
  • 11
  • 1
  • What machine is trigging the authentication prompt? The SQL Server or the web server? Are the documents stored within a database table or within a FILESTREAM table? If FILESTEAM how are you accessing the object? – mrdenny Dec 20 '10 at 04:42
  • ByteArray is coming from DB Column of varbinary(max). Integrated Security used in connection string and service account set in app pool. The app pool identity is not the same identity collected via the basic auth prompt when initially logging into the site. Possibly this is where I'm missing a response header when making the request to IIS, something specific to Office Documents. This does not happen with PDF or other document types. – EdenRockStar Dec 20 '10 at 23:08

0 Answers0