Firefox login credential prompt for Flex App on AD network

[BarnabyRockwell]

I have a http Flex app running on an internal network on which Active Directory (AD) is implemented.  Our server is running Windows Server 2008 R2 x64, with ArcGIS for Server 10.2.1 and Flex Viewer 3.6.  ArcGIS for Server security has been configured using Built-in security:

Configuration Settings   User Store:  ArcGIS Server Built-in Role Store:  ArcGIS Server Built-in Authentication Tier:  GIS Server Authentication Mode:  ArcGIS Tokens

When the Flex app is viewed in Firefox, there is a login prompt.  If AD credentials are entered, then all layers in the App are viewable.  If the app is viewed in Chrome or IE, there is no login prompt.

I can configure Firefox to make the server a trusted URI as per:

http://markmonica.com/2007/11/20/firefox-and-integrated-windows-authentication/

which will stop the prompt for credentials from appearing.  Is there a way I can configure the ArcGIS Server (security, web adapter, etc.) to stop the prompts?  Do I have to implement https to stop the prompt?  Will the Firefox login prompt still appear when the public is granted view access to the app? 

No login prompt appears in Firefox when viewing an https Flex app hosted by a different server (ArcGIS for Server 10.2, Flex 3.6), or when viewing another http Flex app on our internal network from a server running ArcGIS Server 10.0/Flex 3.0.

Thank you in advance...

[GISDev1]

What exactly is being authorized after the AD authentication? Access to the index.html on your IIS or something else? It doesn't sound like it is the ArcGIS Server services. Right now, this doesn't sound Flex related to me, but that is quite an interesting behavior you are noticing.

[BarnabyRockwell]

I'm not sure what is being authorized.  If the login credentials are not entered, none of the services in the app will display, leaving only the Flex layout ("frame") and the ESRI basemaps.  The issue is related to how Firefox handles access to the services as compared to Chrome and IE. 

Here is the error that comes up in the Flex app when credentials are not entered:

<<layername here>> layer failed to load: Fault code: Server.Error.Request

Fault info: HTTP request error

Fault details: Error: [IOErrorEvent type="ioError" bubbles=false cancelable=false eventPhase=2 text="Error #2032"]. URL: http://servername/ArcGIS/rest/services/appfolder/servicename/MapServer?f=json

It is not Flex related other than the fact that the login prompt occurs when a Flex app is accessed.  There is no web site set up on the server, and thus no index.html.

Here is the error I get when I try and access "http://servername/arcgis/rest/services" in Firefox:

[ATTACH=CONFIG]32400[/ATTACH]

On the server, Anonymous Authentication is enabled in Windows Server Manager.  I tried enabling Windows Authentication, but that does not stop the request for credentials in Firefox.

[MichaelMiller2]

Sounds like it is security that is being applied on the ArcGIS Server to the services themselves.

[BarnabyRockwell · Accepted solution]

I think I finally figured it out.  Anonymous Authentication was not enabled for the arcgis part of the default web site.  Enabling that stopped Firefox from asking for credentials!  😄

This image shows the IIS Manager section of Server Manager GUI after I enabled Anon Auth:

[ATTACH=CONFIG]32402[/ATTACH]

Anonymous auth had been enabled for the flexviewers and aspnet_client sections (and still is).

[GISDev1]

I think I finally figured it out.  Anonymous Authentication was not enabled for the arcgis part of the default web site.  Enabling that stopped Firefox from asking for credentials!  😄

This image shows the IIS Manager section of Server Manager GUI after I enabled Anon Auth:

[ATTACH=CONFIG]32402[/ATTACH]

Anonymous auth had been enabled for the flexviewers and aspnet_client sections (and still is).

Yes, that would definitely cause the exact behavior you were describing. Glad you figured it out. Make sure to mark your post an answered so the thread shows it was answered.