问题
I've created an intranet site that uses windows authentication
In chrome I can access the site instantly, and in FF it requires Active Directory login. But with IE7 I'm getting the following error:
401 - Unauthorized: Access is denied due to invalid credentials. You do not have permission to view this directory or page using the credentials that you supplied.
Im unsure as to why its okay in other browsers but not IE? Any help appreciated.
Thanks
回答1:
Solution:
IE is using Kerberos and not falling back on NTLM like Chrome and Firefox. You must force NTLM authentication in IIS7.5 by following these steps:
- Select your site.
- Double click authentication.
- Select "Windows Authentication" (ensuring that it is enabled).
- Click "Providers..." in the right hand column.
- Select NTLM and click "Move Up".
Link: windows authentication not working in ie7
回答2:
I'm not familiar with IIS, but in the past few weeks I've had lots of hand-on experience in integrating AD login into web applications. As is quite logical - every Microsoft product would be better integrated with another such, and Internet Explorer (should be valid for all versions, not just 7) automatically passes your AD login credentials as long as you use Active Directory for your Windows login authentication method.
Every other browser will either need to be configured to do so, ask you to type them in manually or will not support it at all. Which explains why Firefox asks you for a username and a password. Under Opera, you'll most likely get the same error message.
My guess about Chrome is that it's your default browser of choice and at some point in time, you've typed in your login creditenials and that session is still active.
All of this would mean (if my assumptions are correct) that you need to use a different AD account to login into this application than Windows and the latter (being automatically passed by IE) is not authorized.
回答3:
It sounds like your environment is not setup properly for Kerberos authentication to take place. There are many things that can cause Kerberos authentication failure. E.g. Clock skew on the server or client, missing SPN on the web server, etc.
Normally, when you configure to use Windows authentication, you are asking to use SPNEGO, which means using Kerberos whenever possible and then fall back to NTLM if Kerberos fails. However, this post pointed out that this is no longer true. IE7 stops at Kerberos in certain cases but not falling back to NTLM.
You can try to disable the "Enable Integrated Windows Authentication" as the post suggested. It looks odd but it actually just turns off the SPNEGO, you will still use the NTLM.
I guess Firefox and Chrome works because they are using NTLM but not Kerberos. From my experience, non-Microsoft browser doesn't do Kerberos out-of-box. You need to do some configuration work to make it happens. For example, in FireFox, you need to set the network.negotiate-auth.trusted-uris parameter. See here
Once you confirm the NTLM for IE7 is still working fine. Then, you can post another question to ask how to fix the Kerberos authentication problem for IIS.
回答4:
start off by looking here and getting a more detailed error description. I had some crazy problems with CRM and it all came down to the order of settings in IIS the answer to the problem ended up being as simple as ; going into iis and then the authentication setting clicking on windows authentication and selecting advanced make sure kernel mode is on click on providers and ensure negotiate is above NTLM.
来源：https://stackoverflow.com/questions/7188994/401-unauthorized-in-ie7-only-with-windows-authentication