Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We have a strange problem on our intranet. The intranet is accessed through http://intranet and http://intranet.company.com. They both point to http://intranetsrv01.domain.com.

We are experiencing login problems when people are switching between the in-house URL and the alternate full URL. For instance, if one's browsing http://intranet and then typing in http://intranet.company.com in the browser, you will get a new login request, which will most likely not go away until you click 'Cancel' and then refresh the page.

Another problem is that if someone is attaching pictures to a list item (the pictures are shown on the front page) by using one of the URL's, people browsing with the other URL will receive access denied for these images, and thereby will get a login prompt per image. After 'Canceling' these prompts (it won't work to login), the images will not show.

Both intranet and intranet.company.com are added as AAMings. I wonder if the problem could be related to the DNS-configuration, but I really don't know. We're using Claims with only FBA.

I can add that when I'm on the http://intranet and asks to log in as differnet user, the login prompt asks me to connect to http://intranetsrv01.domain, while when I'm on http://intranet.company.com and tries the same, it asks to log in to http://intranet.company.com

Update: I'm pretty sure the AAM are configured errorenously. Please take a look at this:

Internal URL                  Zone          Public URL for Zone
http://intranet.company.com   Default       http://intranet.company.com 
http://intranet               Intranet      http://intranet 
http://intranetsrv01          Custom        http://intranetsrv01
share|improve this question

3 Answers 3

up vote 0 down vote accepted

For forms based authentication (FBA) no single sign on is possible. The authentication is stored in a cookie (not the username and password, just "the authentication"). Cookies won't transfer from one URL to another and thats a good thing. Google don't need to know about your facebook activities.

I would recommend to switch from 3 AAM settings to just the default zone and redirect to add the other url's to the default zone as internal so a redirect will happen.

Another option is to evaluate a claims based authentication provider instead of the build in forms auth solution. Using this mechanism the cookie will be present for the loginpage (e.g. http://login.company.com) and no matter from what url as long as the login url is caching your authentication your are fine. No easy way... but services like Office 365 is doing it in sharepoint online (teamsite and mysites run un different hosts).

More information:

share|improve this answer
    
Pretty scary, but we confed AAM like you said a couple of hours before this post. Our config now uses one public url (intranet.company.com) and one zone with three internal urls. Seems to work okay. –  tarjeieo Sep 13 '11 at 6:29

I assume you probably have both AAM's being serviced by a single SharePoint web application/zone, with both host headers configured on the IIS web? If you are, I might suggest extending the web application, and have each AAM actually serviced by a separate zone. Also, make sure your DNS are A records, and not CNAMES.

share|improve this answer
    
i don't believe a A-Record will help. Yey using windows authentication and kerberos will require for certain browsers ;-) so use an a record, but he is using FBA, so need to think about kerberos. also not sure why it should help to have 2 seperate iis web apps... –  Marco Scheel Sep 12 '11 at 20:33

You may want to make sure that both hosts names are in your local intranet zone and that zones are configured properly with regards to automatic login.

share|improve this answer
    
Both are in the intranet zone in the browser. How do I conf. automatic login? –  tarjeieo Aug 25 '11 at 10:10
    
Internet Options / Security / Local Intranet / Custom Level / User Authentication / Logon –  Muhimbi Aug 25 '11 at 10:53
    
The problem unfortunately persists. –  tarjeieo Aug 25 '11 at 11:00
    
We are talking about FBA no auto login is available here. no matter what your are doing. –  Marco Scheel Sep 12 '11 at 20:34
    
FBA was not mentioned in the original question. –  Muhimbi Sep 13 '11 at 6:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.