[isalist] Re: Internet Explorer 7 password prompt won't work

I've just spent almost all day at the client site, trying to dianose this, and 
then workout a solution.
 
I was able to have 2 PC's side by side, 2 identical desktops,  restored from 
the same ghost image of the SOE, both updated with latest virus sigs, and 
updated from the microsoft update site, except that only one, was also allowed 
to updated to IE7, the other is using IE6.  Same user, same network segment, 
same gateway, neither had the firewall client installed. Other software such as 
office etc installed was identical.  
 
The IE proxy settings were set to be identical, Auto Detect was turned off, 
configuration script turn off, proxy server entered using the name, port set to 
8080. 
 
Visiting the same web sites in the same order, clicking the same links, IE6 no 
password prompts, not even 1. But,  IE7, password boxes everywhere, sufficient 
to make it totally unusable. As I suspected, this testing pretty well rules out 
the ISA as the cause, if it works fine with IE6, then it should work with IE7 
as well. IE7 must have something set differently to be doing this, or it's not 
responding to authentication requests appropriately or something, but looking 
at everything under tools I was not able to workout what, but I reckon it must 
be there somewhere. One thought I did have was the Phishing filter, but turning 
it off seemed to make no difference what so ever, even after a power off 
reboot. 
 
I've got the logs from the ISA covering the period of testing, I'm going to 
review them later, if I find anything of interest I'll post what I find.

________________________________

From: isalist-bounce@xxxxxxxxxxxxx on behalf of Chris Addicks
Sent: Tue 14/Nov/2006 02:51
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work



http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------
 
Jim,

Thanks for the clarification.

My statement regarding the ISA server generating the username/password
box was a poor choice of words.  I knew the client generated the box
because the ISA server requested the credentials.  And I know that all
initial communication with ISA is 'anonymous', but looking at the
monitoring logs in the ISA Server Management application, it is usually
followed by a request with the actual user credentials.  This never
occurred with IE7.

I am using ISA 2004 Standard Edition, SP2, no additional hot fixes after
SP2.  The box is Windows 2003, SP1, with all updates as of today, except
the IE7 upgrade.

I read with interest Glenn Johnston's post and decided to try a few
experiments.

On a Windows XP virtual machine, I loaded IE7

Logging on with my usual account, I tried to use IE7 and got the
username/password box and tried to use my login account, again with no
success.  I tried another username and password, and was successful.
Each time I checked the remember password box.  I closed IE7 and
reopened it and got through with no prompt.  The ISA monitoring log show
that I am using the second username, not the one I logged in with.
Logged off and logged on again, and IE7 worked fine still using the
second username.

Logged off, and logged on, this time using the second username.  Opened
IE7 and got through without the prompt.

Logged off, and logged on as Administrator.  Opened IE7 and got through
without the prompt.  The ISA monitor shows the Administrator username
being passed to it.

I removed my normal user's profile from the computer and then logged off
and back on using my normal username.  Opened IE7 and was prompted for
username and password.  My usual one would not work, but the alternative
one did.  I tried using the reset button, and the clear passwords
button, but IE7 never prompted again for a username (I had checked the
remember username button), so apparently the reset button doesn't clear
the remembered password.

During all of this, when my normal username/password failed, I checked
AD to be sure my account was not locked out.  It wasn't.

I have only had this problem with the released IE7, not the Beta.  I was
running the Beta fine, downloaded and installed the release version,
immediately hit this problem.

Sorry for being long winded, but wanted to show my attempt at
troubleshooting in detail.


Chris

-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Jim Harrison
Sent: Saturday, November 11, 2006 9:58 AM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work

http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------
 
Let's clarify a couple of things first:
"..it should have problems with Microsoft's own firewall product.."  IE7
was tested against ISA 2004 & 2006 (I still hurt from some of that).
What you describe is not "normal behavior".

"..I think it must be something on the ISA server, that is where the
username and password box is coming from.."
Not even close; any authentication popup you see is generated by the
client application; never the server.  It is however generated (again;
by the client application) as a result of the server/proxy replying to
the request with a "must authenticate" response.  Please don't go the
"but FBA is generated by the server" route; this isn't an
"authentication popup" as we're discussing here.

"..my pc is not sending user credentials and appears to be only trying
to access the internet as an anonymous user.."  Get used to it; this is
the way of HTTP communication.
It happens as like unto thusly for all web requests.
1. client connects to server/proxy
2. client sends "gimme stuff"
3. server/proxy responds with "tell me who you are"
4. client sends same request as before, but this time with credentials
5. server/proxy responds according to its (dis)like of those credentials

Thus, all ISA things being equal between IE testing events, the
difference is in IE.
Again; this is dependent on "all ISA things being equal"...

I too have been playing with ISA & IE through all the various beta & RC
releases and have never observed the behavioral changes you describe.

Thus, you must have either changed:
ISA settings
IE settings

What you don't state is:
- ISA edition; SE or EE?
- ISA patches; what SP / rollup level are you running?
- IE configuration:
  - what defaults have you changed?
  - have you used the very-useful "reset " button (Tools, Internet
Options, Advanced, "Reset" button)?

-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Chris Addicks
Sent: Friday, November 10, 2006 12:20 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work

http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------
 
I do not have the "require all users to authenticate" checked.  I prefer
to specify the authentication in the individual rules since we have some
specific client programs that we are required to use that will not
provide authentication, so for those destinations and protocols only, I
allow non-authenticated traffic through.  If I checked the box, like
Thor, then these clients would fail.

One thing to point out.  I did not have this problem with the final RC
of IE7.  It only occurred when I loaded the released version.  We also
get the username/password box occasionally even with IE6, but supplying
the info clears it.


Chris

-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Thor (Hammer of God)
Sent: Friday, November 10, 2006 2:46 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work

http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------
 
Except that anonymous access will still be possible.  I require all
users to authenticate at the listener and have not had any issues like
this at all.

t


----- Original Message -----
From: "Mark Morgan" <MMorgan@xxxxxxxxxxxxxxxxxxxxx>
To: <isalist@xxxxxxxxxxxxx>
Sent: Friday, November 10, 2006 11:35 AM
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work


http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------

Uncheck "require all users to authenticate" on the ISA, it will still
authenticate and your problem should go away.

-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On
Behalf Of Chris Addicks
Sent: Friday, November 10, 2006 11:03 AM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work

http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------

Ara,

I just restarted the whole server and still no luck.  I monitored the
traffic from my pc on the firewall, and it is failing my general
internet access rule because my pc is not sending user credentials and
appears to be only trying to access the internet as an anonymous user.


Chris

-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Ara Avvali
Sent: Friday, November 10, 2006 12:12 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work

http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------

Do you think you can restart firewall service? There will be a shortage
but it may help. Sometimes it happens to me and this is the only way I
can get it go away. Actually it happens after restarting the PDC

-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Chris Addicks
Sent: Friday, November 10, 2006 9:06 AM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work

http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------

Steve,

I just checked and integrated authentication is enabled.  I tried
loading it on another machine, and still no luck.  I think it must be
something on the ISA server, that is where the username and password box
is coming from.
I
just can't figure it out.


Chris

-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Steve Moffat
Sent: Friday, November 10, 2006 8:19 AM
To: ISA Mailing List
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work

http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------

It's not an IE 7 issue, I have just finished a 500 user rollout with no
IE7 / ISA issues.

Is integrated authentication enabled  in IE7 properties?

S

-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Chris Addicks
Sent: Friday, November 10, 2006 9:03 AM
To: ISA Mailing List
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work

http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------

Roland,

Sorry for being dense, but I don't know what you mean by the "section
checked passwords".  If you mean the checkbox to remember passwords, I
have tried it both checked and unchecked.  I have also entered my
username in all the forms I could think of: domain\username,
username@xxxxxxxxxxxx, domain.local\username, etc.  I have since
unloaded IE7 so I could function, but it strikes me as odd that it
should have problems with Microsoft's own firewall product.


Chris

-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Mueller, Roland
Sent: Thursday, November 09, 2006 1:55 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work

http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------

I would research the section "cheched passwords" on the requesting
client.

Roland

-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Chris Addicks
Sent: Tuesday, November 07, 2006 3:35 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Internet Explorer 7 password prompt won't work

http://www.ISAserver.org <http://www.isaserver.org/> 
-------------------------------------------------------

We have been using ISA 2004 for some time now with no problems.  We have

configured it to require user authentication for access to the internet
from our internal network.  I have been using IE7 Beta with no real
problems, but when I loaded the IE7 production release, I am prompted
for a username and password by the isa server, and no matter how I enter
it, I cannot get through the firewall.  I have also tried to load IE7 on
another machine, one that has not had the IE 7 beta, and it does the
same thing.  Anyone know

what is going on here, I am sure it is just something I am missing?
Thanks
in advance, and my apologies if this has already been covered.  I tried
to find info on the isaserver.org site, but couldn't.


Chris


All mail to and from this domain is GFI-scanned.

------------------------------------------------------
List Archives: http://www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials:
http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com <http://www.techgenix.com/> 
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx

------------------------------------------------------
List Archives: http://www.freelists.org/archives/isalist/ 
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials: http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com <http://www.techgenix.com/> 
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx



Other related posts: