2

I'm building an Intranet application based on Ext JS and webservices. Users are authorized using Integrated Windows Authentication, which works fine in IE.

Because my application is in JavaScript, it is loaded in Firefox, but then when I request some data from server I get 'access denied' in Firebug, because all webservices are checking user rights.

Can I request the user to enter his username and password (like login to FTP or a simple login page) in all browsers that don't support Integrated Windows Authentication?

I know there are plugins for Firefox, but I would like a secure solution that don't require plugins.

1 Answer 1

6

Windows Authentication is performed via NTLM. If a browser doesn't automatically supply the credentials then a username/password dialog should be shown in all browsers which would prompt the user to enter their credentials. This should happen automatically.

If you can edit the config settings in FireFox then you can make the credentials be submitted automatically by adding the domain to network.automatic-ntlm-auth.trusted-uris in about:config.

Wiki article about windows authentication

5
  • 1
    Firefox throws login windows for normal asp pages, but if I do a static html page with javascript that calls webservices I don't get that window and also no response from server because of windows authentication :/
    – Misiu
    Jun 19, 2012 at 9:22
  • @Misiu: I have set up a test page which requests a page secured using windows authentication and it works as I would expect, that is a dialog is shown and prompts for authentication details. Is the web service on the same domain as your intranet? If not, then you may be encountering a security issue as by default cross domain requests are not allowed. Have you looked at the request activity using something like FireBug? You should get a 401 response from the request to the secured resource.
    – detaylor
    Jun 19, 2012 at 10:55
  • I get error that looks like this: "500 Internal Server Error: Login failed for user \u0027NT AUTHORITY\\ANONYMOUS LOGON\u0027.","StackTrace":" at System.Data.SqlClient.SqlInternalConnection" and I've just notice that I cant load js files because of 401 error. All files and services are in the same domain.
    – Misiu
    Jun 19, 2012 at 12:30
  • 1
    @Misiu, it appears from your error message that you have anonymous login enabled on you site. If so, disable anonymous access so that the site requires valid credentials.
    – JoshL
    Oct 4, 2013 at 1:55
  • @JoshL - thanks for tip :) ANonymous login was just one case, configuration of all servers was another. I fixed those two and everything works fine, even Chrome :)
    – Misiu
    Oct 4, 2013 at 5:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.