2

We have a SharePoint intranet site and would like to force our users to log in. The site is setup with windows authentication, but the users are logged in automatically when they navigate to our site. I know about the Custom level setting in intranet zones, but that is as far as I know a client setting that we cannot control. I found some articles to use FBA, but I did not have any luck with this. When I navigated to our site I got a dropdown list and if I selected windows authentication it logged in automatically again.

Does anyone have any suggestion of what can be done? One option is basic authentication and I guess that would be ok since we are using SSL.

Improve this question
3
  • You don't have access to change the client settings with a GPO?
    – Anders Aune
    Mar 11, 2013 at 9:04
  • Unfortunately no. There will be computers that are not a part of our domain that will connect to our network and access our page.
    – Eebo
    Mar 11, 2013 at 9:59
  • Are you trying to force the browser to 'not-remember' the user credentials? That would be messing with the user's application itself. You can create your own login page with deceiving text controls to fool browsers; break the web in other words... not recommended.
    – Ricardo C
    Mar 11, 2013 at 16:55

3 Answers 3

Reset to default
1

The users are automatically logged on, if they bear a valid Kerberos-Token and the site fullfills some requirements (Non-FQDNs work most times). This will only happen to users part of the same domain (so users outside of your domain will be asked for credentials).

To remove this behavior (which comes from Windows-Integrated with NTLM or Kerberos) just deactivate Windows-Integrated authentiction. I'd recommend basic auth, since the FBA comes with other pitfalls.

For clearification:
The fact if an application is claims-aware does not decide if you will be promted for your credentials or not. This only depends on the choosen authentication method (which may be "Windows Integrated" (=Kerberos or NTLM), Basic or Form-Based). The built in logic in your Browser will decide if it will prompt or not.
Form-Based will always be promted (if you don't save your credentials in a cookie or whatever).
Basic will always be promted (you can store that in your browser).
NTLM (=Negotiate) might promt you for credentials in some circumstances (no SSL, some FQDN issues, whatever - IE will more likely pass through your authentication than Chrome and FF).

If you want to see which method is used or available, use fiddler and look into the authentication-headers. There's also an optical difference between NTLM and Basic, and NTLM needs the Domain (Basic knows a default domain).

All three methods CAN authenticate against ActiveDirectory (do Windows-Authentication) but only NTLM has to.

Improve this answer
11
  • Thanks for your input. One thing I noticed is that my central administrations always prompts me for username and password and as far as I can see it is also set up with WI-authentication.
    – Eebo
    Mar 11, 2013 at 11:27
  • I'm not sure about the rules, which IE uses to determine if Auto-Login is okay, but NON-FQDN are nearly always auto-logon, pages in intranet-zone often use auto-logon and FQDN with SSL might auto-logon. But nethertheless there's little reason to allow an domain user another login than his own.
    – TGlatzer
    Mar 11, 2013 at 11:33
  • If I understand you correctly i should go for the basic authentication solution. Doing so my smartclients fail, but that is an issue for another forum ;-) Thanks again for your input.
    – Eebo
    Mar 11, 2013 at 12:43
  • Central Admin will always prompt you as it's setup for Basic Auth - it's not a 'claims aware' application so when you hit it, it asks your PC for credentials. Claims Aware apps with NTLM with tell your browser 'I accept NTLM or Kerberos tokens' and your browser tries again with a token. (I could be wrong here, I can't remember how SP2007 worked [no Claims!])
    – James Love
    Mar 11, 2013 at 13:25
  • @JamesLove to extend your comment: SP15 (2013) will use Claims-Aware-Auth in CA, too.
    – TGlatzer
    Mar 11, 2013 at 13:27
0

"and would like to force our users to log in"

Could you disable anonymous authentication? If you do, users will always be prompted to log-in. If by "force" you mean that you want the user to log-in without giving credentials, it probably can not be achieved if you have users outside your domain.

Improve this answer
1
  • We want our users to always enter a username and password. Anonymous authentication is disabled, but using Windows Authentication the user only have to authenticate the very first time they enter the site. As mentioned in the other answer basic authentication will always prompt for a username and password. However our smartclients wont work, but that is for another forum.
    – Eebo
    Mar 11, 2013 at 15:04
0

A potential workaround...

If you can control the link people use to reach the SharePoint site, you may find it's sufficient to force them to go directly to the closeConnection.aspx page with a "Source" value set to the page you want them to go to after they log in.

For example, if the desired "landing page" is http://sharepointsite.example/sitecoll/site/ then try setting the hyperlink to:

http://sharepointsite.example/sitecoll/site/_layouts/closeConnection.aspx?loginasanotheruser=true&Source=http%3A%2F%2Fsharepointsite.example%2Fsitecoll%2Fsite%2F

Note that the "Source" value is URL-encoded, so for example you need to represent the colon (:) as %3A and each slash (/) as %2F

This solution was tested with SharePoint 2010. Tip: Since closeConnection.aspx is in the hive, you can tag the /_layouts/closeConnection.aspx... etc. on to the end of the URL wherever you are in your SharePoint site.

The solution doesn't help if people bookmark pages directly themselves and circumvent entry to the site without closeConnection.aspx.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.