A while ago I asked a question regarding authenticating users from a remote location. Last week I installed an iPhone application developed for SharePoint. It asks the server I want to connect and lets me choose the authentication method (forms, Windows). Upon providing my username and password the app connects to server without problems.

I can understand that it can work with Forms auth but how can it connect to the server with Windows authentication and impersonate the user there?

Any ideas?

2 Answers 2


My guess is the iPhone app only supports NTLM and not Kerberos, as Kerberos would require authentication of the device itself and the iPhone will not have a computer account in the domain.

So NTLM then. This isn't impersonation, but an interactive log on. In this case, when the iPhone tries to connect to SharePoint, IIS will ask for the username in plaintext. The app will send this and IIS will challenge them with a nonce (a random value). The app uses this nonce to encrypt the hash of the password and sends this encrypted data back to IIS. IIS sends the username, nonce, and the encrypted response to a domain controller where it is decrypted and compared to the password hash stored in AD.

Assuming that the supplied credential is valid and authorized, you gain access to the SharePoint site.


SharePoint would let you through if Basic Authentication was enabled on the web application. However that opens up a potential security hole, so in turn if you need to do that make sure the site is using a SSL certificate, or that you can only get to the sites through VPN in the first place.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.