1

We are using SharePoint Server 2016 and have a SharePoint-hosted app deployed.

Everything works fine in Internet Explorer, but when loading the site with Edge or Chrome, I get a login prompt for the resources hosted in the app web. I do not understand why. (The app web is hosted on a different FQDN than the main site, as is recommended.)

When I run Fiddler to analyze the problem - the problem goes away! I have read "Help - Fiddler fixes my app", but I haven't found any solution.

Really appreciate any ideas of what to check, thanks!

2
  • Do your SharePoint 2016 sites open in Chrome without requiring login? Mar 16 at 11:28
  • I have the same problem with a login prompt in Chrome as in Edge when loading resources from my app-domain. It works if I login, but it is annoying. :) If I remove references to the app domain, the SP2016 site loads without login prompts in Chrome and Edge. Are there maybe some enhanced security features in Chromium that prevents automatic loading of resources from other domains? Hmm.
    – greycloud
    Mar 16 at 14:34

1 Answer 1

0

The problem was that Chromium (Edge/Chrome) thinks that our internal app-domain is located on the internet, and therefore ignores the Integrated Windows Authentication (NTLM) request.

To recap how Integrated Windows Authentication works in Edge/Chrome:

From Microsoft:

  • By default, Microsoft Edge uses the intranet zone as an allow-list for WIA.
  • Alternatively, you can customize the list of servers that are enabled for Integrated Authentication by using the AuthServerAllowlist policy.

Unfortunately, there is not much documentation of the interplay between these settings, or what logic "AuthServerAllowlist" uses for determining what sites are internal.

Our app domain was already added to IE:s Local Intranet sites (Edge's ties to Internet Explorer are still here... sigh), so it should not have been a problem. For as of yet unconfirmed reasons it is a problem for several users anyway, maybe due to issues with the GPO application.

When I add the URL to the "AuthServerAllowlist" regkey (see docs for Edge/Chrome) the login prompt disappears. Unfortunately, it seems to be an all-or-nothing solution - now all other internal URLs have to be explicitly added as well or they will prompt you.

Reg location for "AuthServerAllowlist":

  • Edge: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge
  • Chrome: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome

As I see it, "AuthServerAllowlist" (and sister policies, see Edge HTTP authentication policies) is the true replacement in Edge/Chrome for Internet Explorer's Local Intranet sites option. This new policy has been around since Edge 77, in June 2019, but there is a lot of old instructions and blog posts floating around that only ever mentions the ancient Internet Explorer settings.

1
  • The real issue was simpler: our internal app domain were (wrongly) set via GPO to Trusted Sites instead of Local Intranet. But this worked well for many years with IE, and we didn't notice the "error", but Edge/Chromium interprets these zones a bit differently and thus we got problems. We just set the app domain to Local Intranet and all is good.
    – greycloud
    Aug 8 at 10:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.