We have an ASP.Net 4.0 app running on IIS 7.5 on Windows 2008. Our users are all running Windows XP or Windows 7 in a domain context.
Users are authenticated using Windows Authentication.
We have two servers which seem to be configured the same. system.webServer/security.authentication/windowsAuthentication
:
authPersistNonNTLM = False
authPersistSingleRequest = False
enabled = True
system.webServer/security/authentication/anonymousAuthentication
:
enabled = False
The Beta server appears to consistently return Persistent-Auth: true
for all users, whereas the Production server seems to consistently return false
for certain users. There are two developers whose PCs were built at the same time, using the same OS image, with their ActiveDirectory profiles both modelled on mine: one always gets false
, the other always true
.
This is problem because some users generate an Authenticate
: header 10k long (mine is about 3k). Depending on which parts of the app have been used, you may not be able to fit a 10k Auth header and all potential session-cookies within the 16k limit.
What settings might cause the Persistent-Auth header to vary on a per-user basis?