Hot answers tagged ntlm
18
Two HTTP 401 responses is normal when using NTLM authn, that's the way HTTP works.
First it tries an anonymous request which generates the first 401 request. The reponse includes a header that says "try with NTLM".
Then the NTLM procedure (which is a challenge/response method) requires one 401 and finally a 200. If you want more details here's a good link: ...
11
One thing is missing in this discussion that is asked in the question; the difference between NTLM and Kerberos.
NTLM is a properitary AuthN protocol invented by Microsoft whereas Kerberos is a standard protocol.
The big difference is how the two protocols handle the authentication:
NTLM uses a three-way handshake between the client and server and ...
11
NTLM is only allow 1-hop solutions because it is transferring user credentials to the first server - in most cases it is IIS on your SharePoint Front End Server. If you want to get some data from a SharePoint server code (WebPart etc) and ask another server for data (it could be external back-end system you want to integrate to), you can't pass user context ...
7
For you, the big reason is that it solves the "double hop" (delegation) problem, as mentioned in another answer. In addition, the Kerberos authentication mechanism starts to become more efficient as user session time increases, and reduces the load on the domain controller. This is because Kerberos is using an authentication ticket and not having to go back ...
6
Your choices of autentication are Classic/NTLM, Classic/Kerberos, Claims/NTLM and Claims/Kerberos. Basically your questions are: Classic or Claims, and NTLM or Kerberos.
Both questions cover somewhat different concepts and have different implications, although related. There are vast amounts of documentation on both. Here's a short primer on all of this ...
5
Why are you deploying your Custom Web Service to the layouts folder at first place?
You need to copy the Web service files to the _vti_bin virtual directory
Copy the Service1wsdl.aspx file, the Service1disco.aspx file, and the Service1.asmx file to the _vti_bin virtual directory. This is the directory where all default Web services are stored.
Copy the ...
5
A computer in domain2 will not participate in Kerberos in domain1 if there is no trust relation configured between both domains. The fallback is NTLM. To see if kerberos is used you can check with KLIST from a command line (in windows 7 for all other OS user kerbtray from the Windows Resource Kits Tools).
Getting a Word document from SharePoint will never ...
3
After doing some research into this, I have a possible solution to determine ADFS authentication, but I have no way to test this.
Here's the idea (point by point):
1) There is a class called System.Web.Security.SingleSignOn.SingleSignOnIdentity. SingleSignOnIdentity Class - MSDN
2) In Testing Whether ADFS User Is Authenticated they cast the user identity ...
3
@James Love got this on the head, you need to take a look at the cookies
Check out this project "Remote authentication with claims" I believe the answer is here in the code.
It requests the authorisation cookie from the target server if it get's it, it continues. That's your claims based right there.
2
Using NTLM over the Internet isn't desirable due to the potential of proxy servers not being able to handle NTLM authentication, but unless you're communicating with NTLMv1, generally you should be fine. If you're doing it over SSL, then you should absolutely be fine with NTLM.
NTLM is less secure than Kerberos, however.
2
Wictor's answer is an excellent one, but for me the root cause of this issue was IIS' mime-type settings.
IE and Firefox will completely adhere to the mime-type sent by the server (the default one being application/octet-stream for IIS) but also will not play a video if the mime-type isn't correct - video/webm, video/ogg or video/mp4. By contrast Google ...
1
You may also notice that on the "real" FBA zone, if Windows Authentication is disabled, the People Picker won't show AD users either. So you're correct that in order to pick users from the underlying repository, authentication for that repository must be enabled.
You can try using http://spautomaticsignin.codeplex.com/ if you want to automatically sign in ...
1
From what I've learned from working with FBA and the people picker, FBA has to be enabled on that zone in order for the people picker to pull FBA users. You can enable FBA and use a custom login page for the Intranet zone to only authenticate via NTLM (even though FBA is enabled).
I had a post about this recently:
NTLM Authenticated Application, FBA, and ...
1
I answered a similar question recently.
SharePoint 2010 you should use the Secure Store Service (SSS) for these kind of settings (credentials, connectionstrings etc). That provides a user interface for selected users, you can then in your Web Part Property point to the SSS application ID that you want it to use (you could also get fancy and make the ...
1
Kerberos is definitely tricky to get right. I would recommend following the instructions in the following document exactly and in detail. Any small detail can break it and troubleshooting is painful.
http://go.microsoft.com/fwlink/p/?LinkId=196600
Regarding multiple domains, here is what it has to say:
The scenarios in this set of articles about ...
1
Everything here is correct thus far, but generally which one to use? When I'm setting up SharePoint, Single-Server setups are typically NTLM, Multi-Server setups are typically Kerberos. Usually Multi-Server setups one day will involve third party tools, etc. that wish to setup authentication integrated somewhat with SharePoint and being cognizant of that, ...
1
Here's an example of when you need it and when you don't
User >> SharePoint web page with SSRS report viewer via iFrame. NTLM lets user onto the page. User goes direct to SSRS via the iFrame and uses NTLM to authenticate there. Kerberos not required.
User >> SharePoint web page with SSRS report viewer in Integrated Mode. User goes to SharePoint and ...
Only top voted, non community-wiki answers of a minimum length are eligible
