We have an internal portal on SharePoint Server 2010. For example portal.abc.com. We are using Windows authentication (NTLM).

When users access the portal from a joined computer in an Active Directory domain, everything works fine, however, we have some users that work with iPads using mobile Safari.

Users need only read the information on the portal. They use VPN (PPTP). Every time when these users try to log into the portal, SharePoint prompts for credentials. Every time.

Does anyone know how to fix it? I'll be glad to any suggestions as to prevent users from such inconveniences.

3 Answers 3


As the iPad is not a domain device, it doesn't have the capability for cached credentials. The most robust solution I've seen on an iPad uses TMG to handle the authentication component. When the user hits the SharePoint site, they're prompted by TMG for user credentials. TMG then securely processes the authentication and provides the handoff to SharePoint. You can also implement a SSO style solution using this same method so that as users move from one web application to another (ie: intranet and mysites) they are not prompted for additional authentication, as it's all funneled through TMG.

This may be a heavier solution than you're looking for, but it is a more robust way of handling that mobile device connectivity end of things.

  • But how do you think it is possible to somehow use client certificates without using TMG? I certainly know that Sharepoint does not provide built-in support for Client Certificate Authentitsation. Can this be done using IIS?
    – SDG
    Jun 9, 2012 at 4:18
  • I'm fairly certain that certificate authentication can be handled with TMG, the question that comes to mind is the compatibility and ability to load the certificate onto the iPad. I haven't used that approach, so I'm not sure if the iPad would support it; something worth investigating though.
    – webdes03
    Jun 9, 2012 at 14:02

The best way to handle logins from iOS & other non-domain-joined devices is to use client certificates. SharePoint itself does not support login via certificates which is why you need an intermediary (e.g. TMG / AD FS).

The easiest -but not perfect solution- is to keep relying on NTLM login and enable Kerberos - at least the user would not have to login for every other domain (different web applications). The user would still have to login each time he visits your SharePoint.

The certificate solution needs a TMG or AD FS (Active Directory Federation Services) server to handle to certificate solution. You can find an older tutorial on how to set this up here:

Microsoft even has a nice image on how to set everything up for SharePoint 2013 (it wouldn't be much different for SharePoint 2010).

ADFS Client Certificate setup (via http://technet.microsoft.com/en-us/library/gg491215%28v=office.15%29.aspx)

I didn't look for tutorials on how to set it up with ADFS, but it certainly is the way I would currently suggest. Just distribute client certificates to your users which is even possible on iOS and they will be able to automatically login and not have to worry about username/password. Not a SharePoint feature, but an ADFS feature.


Exploring these two items may be helpful - Disable the Loopback check in the server and put the site in a Trusted Zone in the (Safari) browser. Another (lesser secure) way is to use Basic authentication.

  • Thank you. Of course, I'll try, but I doubt it will help. But if it will help, it will be very great.
    – SDG
    Jun 9, 2012 at 4:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.