Dear Ladies and Gentlemen,
We are building a web application that is either deployed by our company in a cloud environment, or - this is the more common use case - directly at a client's site as part of their intranet.
For that latter variant, we also provide an SSO solution that can use whatever SSO infrastructure the client has available. Very often this is IIS or they do not have anything in which case we also suggest using IIS since our clients almost exclusively have Windows environments.
Our solution generally works like this:
- Browser sends request to IIS which works as reverse proxy
- IIS "enriches" request with user data taken from AD
- IIS forwards request do our web application running Apache Tomcat using the isapi_redirect.dll
This usually works perfectly and we have working installations at a lot of clients.
For one of our clients this does not work. They use Internet Explorer 11 and have IIS 7.5 hosted on a Server that is part of their intranet. When they access our start page, they get a login dialog from the browser for username and password. Providing this data does not work.
We checked if the page is really part of the local intranet and it is. We also tried adding it to the trusted zone, but this didn't change the behavior.
What DID work, was removing the checkbox in "Enable Integrated Windows Authentication" in the Advanced Internet Explorer Settings. After removing this checkbox, the login dialog did not appear and the user was correctly forwarded to our web application.
However, this is not really a solution for our client, as they would have to change the IE settings for all of their users and don't want to do this. Also, we want to understand why the browser/IIS behaves like this, and what might be wrong here.
We also tried using an alias instead of the normal URL that they use to access the web application, in case IE somehow thinks that the URL could not be part of the local intranet zone, but to no avail.
Any input is highly appreciated!
We did research on this phenomenon and possible solutions, but so far nothing we found solved the solution at our client.
If there is a better forum in which I can pose this question, I'll happily do so. It was suggested to post this in the IIS section, but I did not find such a section in the list of available forums.
Many thanks in advance and Best Regards
Mathias Winklhofer