4

We have a strange problem on our intranet. The intranet is accessed through http://intranet and http://intranet.company.com. They both point to http://intranetsrv01.domain.com.

We are experiencing login problems when people are switching between the in-house URL and the alternate full URL. For instance, if one's browsing http://intranet and then typing in http://intranet.company.com in the browser, you will get a new login request, which will most likely not go away until you click 'Cancel' and then refresh the page.

Another problem is that if someone is attaching pictures to a list item (the pictures are shown on the front page) by using one of the URL's, people browsing with the other URL will receive access denied for these images, and thereby will get a login prompt per image. After 'Canceling' these prompts (it won't work to login), the images will not show.

Both intranet and intranet.company.com are added as AAMings. I wonder if the problem could be related to the DNS-configuration, but I really don't know. We're using Claims with only FBA.

I can add that when I'm on the http://intranet and asks to log in as differnet user, the login prompt asks me to connect to http://intranetsrv01.domain, while when I'm on http://intranet.company.com and tries the same, it asks to log in to http://intranet.company.com

Update: I'm pretty sure the AAM are configured errorenously. Please take a look at this:

Internal URL                  Zone          Public URL for Zone
http://intranet.company.com   Default       http://intranet.company.com 
http://intranet               Intranet      http://intranet 
http://intranetsrv01          Custom        http://intranetsrv01
Improve this question

3 Answers 3

Reset to default
0

For forms based authentication (FBA) no single sign on is possible. The authentication is stored in a cookie (not the username and password, just "the authentication"). Cookies won't transfer from one URL to another and thats a good thing. Google don't need to know about your facebook activities.

I would recommend to switch from 3 AAM settings to just the default zone and redirect to add the other url's to the default zone as internal so a redirect will happen.

Another option is to evaluate a claims based authentication provider instead of the build in forms auth solution. Using this mechanism the cookie will be present for the loginpage (e.g. http://login.company.com) and no matter from what url as long as the login url is caching your authentication your are fine. No easy way... but services like Office 365 is doing it in sharepoint online (teamsite and mysites run un different hosts).

More information:

Improve this answer
1
  • Pretty scary, but we confed AAM like you said a couple of hours before this post. Our config now uses one public url (intranet.company.com) and one zone with three internal urls. Seems to work okay.
    – tarjeieo
    Sep 13, 2011 at 6:29
0

I assume you probably have both AAM's being serviced by a single SharePoint web application/zone, with both host headers configured on the IIS web? If you are, I might suggest extending the web application, and have each AAM actually serviced by a separate zone. Also, make sure your DNS are A records, and not CNAMES.

Improve this answer
1
  • i don't believe a A-Record will help. Yey using windows authentication and kerberos will require for certain browsers ;-) so use an a record, but he is using FBA, so need to think about kerberos. also not sure why it should help to have 2 seperate iis web apps...
    – Marco Scheel
    Sep 12, 2011 at 20:33
-1

You may want to make sure that both hosts names are in your local intranet zone and that zones are configured properly with regards to automatic login.

Improve this answer
5
  • Both are in the intranet zone in the browser. How do I conf. automatic login?
    – tarjeieo
    Aug 25, 2011 at 10:10
  • Internet Options / Security / Local Intranet / Custom Level / User Authentication / Logon
    – Jeroen Ritmeijer
    Aug 25, 2011 at 10:53
  • The problem unfortunately persists.
    – tarjeieo
    Aug 25, 2011 at 11:00
  • We are talking about FBA no auto login is available here. no matter what your are doing.
    – Marco Scheel
    Sep 12, 2011 at 20:34
  • FBA was not mentioned in the original question.
    – Jeroen Ritmeijer
    Sep 13, 2011 at 6:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.