1

Windows Server 2012 R2
IIS 8.5
Internet Explorer 11

I have an IIS web application that supports Windows Authentication (Providers: Negotiate, NTLM).

I have a use case where a given user has multiple accounts. His IE settings consider the site to be "local intranet" zone and as such, automatically attempt to logon with the username he's logged in Windows with. He needs to use his other account to properly authenticate with the site but doesn't get a challenge prompt to enter the credential. When this happens, the site immediately returns a 403 error and that's it.

Is there a way to configure the IIS site to challenge the user to authenticate instead of give up? I can't remove the site address from the "Local Intranet" Zone in his browser due to security policies and likewise, I can't change the automatic logon policy for the entire Local Intranet Zone.

Is there another way?

Mike B
  • 11,570
  • 42
  • 106
  • 165
  • What OS the client is on ? You could setup his another account in the Account Control's section of his profile. aka there; Control Panel\All Control Panel Items\Credential Manager – yagmoth555 Mar 15 '18 at 17:50
  • Windows 7 and Windows 10. Interesting, I'll look into that, thanks. – Mike B Mar 15 '18 at 19:29
  • Why use IE11? If the admin hasn’t configured GPO for Chrome or Firefox those browsers won’t do that. Just have him use an alternate browser for this purpose. Firefox would be my first choice because it’s so ridiculously complicated to apply GPO most people won’t even screw with it. But using an even more obscure browser like Opera or something would almost definitely do the trick. – Appleoddity Mar 16 '18 at 03:41

1 Answers1

1

There is nothing in the IIS configuration that has influence on how a browser gets the credentials to be send to the server.

One workaround for your problem is:

Make sure the Windows account needed to log into the site, is also a user on the user's Windows OS.

Have the user start a separate IE instance under that second user account, then if set up to log in automatically, it should work without entering the credentials again.

Peter Hahndorf
  • 13,763
  • 3
  • 37
  • 58