nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

IWA Login for Portal Prompting for Credentials

Andrew-Bowne

Hi All!

I have IWA configured for our on-premise portal and we are having a problem where users are being prompted to enter their Windows credentials before accessing portal. From the documentation that I have read, users should pass right through and not have to log in at all as long as they have a user account (which they do). From the Documentation:

When you use IWA, logins are managed through Microsoft Windows Active Directory. Users do not sign in and out of the portal website; instead, when they open the website, they are signed in using the same accounts they used to log in to Windows.

Does anyone else experience this? Is there a workaround or an IIS setting that I'm missing?

I can add the URL as a Trusted Site but I don't see this as a viable solution.

Thanks!

Najděte více příspěvků označených jako

Accepted answers

All comments

AnthonyRyanEQL

Andrew,

On IIS have you enabled windows authentication and disabled anonymous access? also what browser are you using?

GISSupport3

Is the prompt coming from the Portal or your firewall / load balancer?

JoshuaBixby

Check which security zone your Portal is showing up in for the clients. Credentials don't get automatically passed through for all security zones.

Andrew-Bowne

Yes I have enabled only Windows Authentication. This is happening in both Chrome and IE. I haven't tried Firefox as of yet because it is not a favored browser in our org. Most users are Chrome and IE

Andrew-Bowne

It is coming from the browser/windows so I'm assuming that would be firewall. It is not from Portal.

Andrew-Bowne

It's in the "Internet" zone which I find odd because it is located on our intranet. It is NOT public facing.

JoshuaBixby

Although the article is dated, the overall information is still accurate today: https://support.microsoft.com/en-us/help/258063/internet-explorer-may-prompt-you-for-a-password .

There are several ways to address the issue if the problem is tied to browser security zones. One way is to ensure the site is in the local intranet zone, which allows credential passing by default. Another option is to enable credential passing in the internet zone, which I strongly discourage. If you are not able to manually change IE security settings because of group policy, you will have to reach out to your IT department to ask about why your site is showing up in the internet zone.

NickHarvey

Hi Joshua - Thanks for mentioning browser settings (security zones) - It was key in getting ours working with (first) IE, Edge, and Chrome. This video was really helpful, but doesn't cover it as I recall (maybe its implied and I'm lacking).

Anyway, Thanks! So, Firefox remains an issue for us though. It appears accepting AD credentials is somehow tied to Firefox cached site data or browsing history. Is there a Firefox config similar to IE internet options>Security> zones?

Thanks

-Nick

JoshuaBixby

FF does not rely on the Windows security zones or certificate stores. If you search the web, you will find numerous blog posts and forums that describe enabling FF for IWA.

NickHarvey

Yep that did the trick (now works in Private Browsing, etc) Thanks Again!

NathanHeickLACSD

I wanted to add to this topic. I was having similar behavior.

What I found was that I was using the etc/hosts file while migrating to a new server to map our production server alias to the local server. Initially, I entered the following:

#.#.#.# alias.domain.com

It worked for a lot of things like setting up the web adaptor. It didn't work once I got to setting up IWA. While troubleshooting, I tried using the machine name instead of the alias and IWA worked. So, I then tried modifying the etc/hosts file as follows:

#.#.#.# machinename.domain.com alias.domain.com

I'm not well-trained in networking so I don't know why leaving the machine name out of the entry caused an issue. I do know it fixed my problem.

Marshal

I am working on doing the same and this really helped me out! Thanks a bunch!

NitinChauhan

This Link helped me for configuring the settings in edge /chrome

https://documentation.stormshield.eu/SNS/v4/en/Content/SSO_configuration_-_Microsoft_SPNEGO/Configuring-Internet-Explorer-Edge-Chrome.htm

Připojte se ke konverzaci

Přihlášení členové mohou přispívat, sledovat aktualizace a další. Jste tu noví? Zaregistrujte si bezplatný účet.

Rychlé odkazy

Community Help
Find useful guides, FAQs, and documents to help you navigate and make the most of Esri Community.