2

Does SharePoint 2010 keep passwords in cookies (in any form hash/encrypted)? I don't think so as long as the authentication mode is Windows, am I right in thinking that?

I have already read the persisten cookie white paper at http://www.microsoft.com/en-us/download/details.aspx?id=30447 so please do not redirect me there. It has a section for authentication cookie but that also doesn't suggest that is keeps password somewhere.

I would be amazed if SharePoint (after all a web site so on client side just HTML) has the capability to get the password from domain-controller or some local store in an encrypted way then keep it in some cookie?

If it doesn't keep the password then how does it lets Office Applications open and edit documents?

I am really confused :-?

1 Answer 1

2

Sharepoint does not store passwords. It uses different HttpModules to authenticate you (such as the Windows Auth Module).

Also, remember that Sharepoint is built on top of ASP.Net, so it uses the .Net authentication mechanisms.

Let me try to explain the concept of authentication in ASP.Net

  1. Client makes a request to the server.
  2. Server replies back to the client on which authentication mehotds are supported.
  3. Client sends through authentication (normally NTLM).
  4. Server receives credentials and if NTLM, it contacts Active Directory and authenticates you.
  5. Server replies saying you are authenticated. Server also adds the persisted authentication cookie to your browser so that it does not have to query active directory everytime you make a request.

Read more about the subject here: http://msdn.microsoft.com/en-us/library/eeyk640h(v=vs.100).aspx

2
  • Thanks fox for your answer, it definitely helped.Reading about kerberos also helped.
    – asolvent
    Jan 10, 2013 at 16:39
  • No problems. Please mark as answer if you are satisfied
    – Fox
    Jan 11, 2013 at 8:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.