Login trouble between URL's that point to the same server

Question

We have a strange problem on our intranet. The intranet is accessed through http://intranet and http://intranet.company.com. They both point to http://intranetsrv01.domain.com.

We are experiencing login problems when people are switching between the in-house URL and the alternate full URL. For instance, if one's browsing http://intranet and then typing in http://intranet.company.com in the browser, you will get a new login request, which will most likely not go away until you click 'Cancel' and then refresh the page.

Another problem is that if someone is attaching pictures to a list item (the pictures are shown on the front page) by using one of the URL's, people browsing with the other URL will receive access denied for these images, and thereby will get a login prompt per image. After 'Canceling' these prompts (it won't work to login), the images will not show.

Both intranet and intranet.company.com are added as AAMings. I wonder if the problem could be related to the DNS-configuration, but I really don't know. We're using Claims with only FBA.

I can add that when I'm on the http://intranet and asks to log in as differnet user, the login prompt asks me to connect to http://intranetsrv01.domain, while when I'm on http://intranet.company.com and tries the same, it asks to log in to http://intranet.company.com

Update: I'm pretty sure the AAM are configured errorenously. Please take a look at this:

Internal URL                  Zone          Public URL for Zone
http://intranet.company.com   Default       http://intranet.company.com 
http://intranet               Intranet      http://intranet 
http://intranetsrv01          Custom        http://intranetsrv01

Answer 1

For forms based authentication (FBA) no single sign on is possible. The authentication is stored in a cookie (not the username and password, just "the authentication"). Cookies won't transfer from one URL to another and thats a good thing. Google don't need to know about your facebook activities.

I would recommend to switch from 3 AAM settings to just the default zone and redirect to add the other url's to the default zone as internal so a redirect will happen.

Another option is to evaluate a claims based authentication provider instead of the build in forms auth solution. Using this mechanism the cookie will be present for the loginpage (e.g. http://login.company.com) and no matter from what url as long as the login url is caching your authentication your are fine. No easy way... but services like Office 365 is doing it in sharepoint online (teamsite and mysites run un different hosts).

More information:

• http://technet.microsoft.com/en-us/library/ff607753.aspx
• http://www.wictorwilen.se/Post/Visual-guide-to-Windows-Live-ID-authentication-with-SharePoint-2010-part-1.aspx
• http://identityserver.codeplex.com/

Answer 2

I assume you probably have both AAM's being serviced by a single SharePoint web application/zone, with both host headers configured on the IIS web? If you are, I might suggest extending the web application, and have each AAM actually serviced by a separate zone. Also, make sure your DNS are A records, and not CNAMES.

Answer 3

You may want to make sure that both hosts names are in your local intranet zone and that zones are configured properly with regards to automatic login.