[isalist] Re: Internet Explorer 7 password prompt won't work
- From: "Glenn P. JOHNSTON" <glenn.johnston@xxxxxxxxxxx>
- To: <isalist@xxxxxxxxxxxxx>
- Date: Thu, 16 Nov 2006 05:53:44 +1100
I haven't had a lot of time to troll thought the logs / captures, but in the
10 minutes I have had, it seems IE6 is sending everything on port 8080,
while IE7 is sending most requests on 8080, but some on 80!, I'm suspecting
at the moment, that what's being sent on 80 is generating the password
boxes.
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx] On
Behalf Of Jim Harrison
Sent: Wednesday, 15 November 2006 01:04
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
As I told Glenn, make sure you get concurrent captures.
The logs are only half of the story.
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Chris Addicks
Sent: Tuesday, November 14, 2006 5:23 AM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
Jim,
I didn't do extensive testing once I got through, but this is what I saw in
a nutshell:
With IE6 the first entry or two were requests to the ISA server itself, port
8080, with the user listed as "anonymous". These would be followed by
requests to the actual website, usually Microsoft TechNet, on port 80, with
the user listed as my login user.
With IE7, when it didn't work, again the first few entries were requests to
the ISA server itself, port 8080, with the user listed as "anonymous".
These requests continued as I entered my login username and password and
were denied and this continued until I closed IE7.
When I then entered my alternate username and password, the behavior was the
same as for IE6 except the user listed was the alternate username.
After all the steps described in my earlier post that resulted in finally
being able to connect without the username/password prompt, the logs looked
the same as for IE6.
Sorry Jim, I did not save the monitor log, but I will see if I can the whole
thing and this time I will export the log, if you want it.
Chris
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Jim Harrison
Sent: Monday, November 13, 2006 5:25 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
What do you find in the ISA logs for those tests?
IE7 "tabs" feature operates as separate IE "instances" and can quickly bury
ISA requests needing authentication.
-------------------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
-------------------------------------------------------
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Chris Addicks
Sent: Monday, November 13, 2006 14:08
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
Granted. We have occasionally used it that way, but now we set the proxy
settings via group policy. Currently, my setup is to have the proxy
specified in the IE options, with the auto not checked.
Chris
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Jim Harrison
Sent: Monday, November 13, 2006 4:55 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
Not exactly.
The browser will "use the FWC" (not exactly accurate) if the proxy settings
are completely removed and "auto" is disabled.
-------------------------------------------------------
Jim Harrison
MCP(NT4, W2K), A+, Network+, PCG
http://isaserver.org/Jim_Harrison/
http://isatools.org
Read the help / books / articles!
-------------------------------------------------------
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Amy Babinchak
Sent: Monday, November 13, 2006 12:57
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
The browser will use the firewall client if your rule allowing http out
requires authentication.
Amy
________________________________
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Chris Addicks
Sent: Monday, November 13, 2006 3:46 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
The browser should not be using the firewall client, but I have tried it
both enabled and disabled.
Here is my latest update, and it just gets weirder:
I loaded IE7 on my main desktop, again. And again, I could not get through
to the web using my login username and password. I did not go any further,
but instead logged off. I logged on as a new domain user I created just so
I could have one that I was sure did not have any sort of cached profile,
anywhere. I was able to get through immediately, no username/password
prompt at all. The ISA monitor showed the correct credentials being used.
I then logged off and logged on again using my usual username and password.
This time, when I started IE7, it got through immediately. Again, the ISA
monitor shows the correct username and password. So now it works, but I
sure wish I knew what the problem was/is.
When I get a chance, I will go to the other user's machine who tried to load
it and see if I can repeat the process. I will let you all know.
Chris
________________________________
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Amy Babinchak
Sent: Monday, November 13, 2006 2:51 PM
To: isalist@xxxxxxxxxxxxx
Subject: RE: [isalist] Re: Internet Explorer 7 password prompt won't work
Maybe there's a problem with your firewall client? Have you tried a repair
or uninstall/reinstall on it?
Amy
________________________________
From: isalist-bounce@xxxxxxxxxxxxx on behalf of Chris Addicks
Sent: Mon 11/13/2006 10:51 AM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
Jim,
Thanks for the clarification.
My statement regarding the ISA server generating the username/password box
was a poor choice of words. I knew the client generated the box because the
ISA server requested the credentials. And I know that all initial
communication with ISA is 'anonymous', but looking at the monitoring logs in
the ISA Server Management application, it is usually followed by a request
with the actual user credentials. This never occurred with IE7.
I am using ISA 2004 Standard Edition, SP2, no additional hot fixes after
SP2. The box is Windows 2003, SP1, with all updates as of today, except the
IE7 upgrade.
I read with interest Glenn Johnston's post and decided to try a few
experiments.
On a Windows XP virtual machine, I loaded IE7
Logging on with my usual account, I tried to use IE7 and got the
username/password box and tried to use my login account, again with no
success. I tried another username and password, and was successful.
Each time I checked the remember password box. I closed IE7 and reopened it
and got through with no prompt. The ISA monitoring log show that I am using
the second username, not the one I logged in with.
Logged off and logged on again, and IE7 worked fine still using the second
username.
Logged off, and logged on, this time using the second username. Opened
IE7 and got through without the prompt.
Logged off, and logged on as Administrator. Opened IE7 and got through
without the prompt. The ISA monitor shows the Administrator username being
passed to it.
I removed my normal user's profile from the computer and then logged off and
back on using my normal username. Opened IE7 and was prompted for username
and password. My usual one would not work, but the alternative one did. I
tried using the reset button, and the clear passwords button, but IE7 never
prompted again for a username (I had checked the remember username button),
so apparently the reset button doesn't clear the remembered password.
During all of this, when my normal username/password failed, I checked AD to
be sure my account was not locked out. It wasn't.
I have only had this problem with the released IE7, not the Beta. I was
running the Beta fine, downloaded and installed the release version,
immediately hit this problem.
Sorry for being long winded, but wanted to show my attempt at
troubleshooting in detail.
Chris
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Jim Harrison
Sent: Saturday, November 11, 2006 9:58 AM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
Let's clarify a couple of things first:
"..it should have problems with Microsoft's own firewall product.." IE7 was
tested against ISA 2004 & 2006 (I still hurt from some of that).
What you describe is not "normal behavior".
"..I think it must be something on the ISA server, that is where the
username and password box is coming from.."
Not even close; any authentication popup you see is generated by the client
application; never the server. It is however generated (again; by the
client application) as a result of the server/proxy replying to the request
with a "must authenticate" response. Please don't go the "but FBA is
generated by the server" route; this isn't an "authentication popup" as
we're discussing here.
"..my pc is not sending user credentials and appears to be only trying to
access the internet as an anonymous user.." Get used to it; this is the way
of HTTP communication.
It happens as like unto thusly for all web requests.
1. client connects to server/proxy
2. client sends "gimme stuff"
3. server/proxy responds with "tell me who you are"
4. client sends same request as before, but this time with credentials 5.
server/proxy responds according to its (dis)like of those credentials
Thus, all ISA things being equal between IE testing events, the difference
is in IE.
Again; this is dependent on "all ISA things being equal"...
I too have been playing with ISA & IE through all the various beta & RC
releases and have never observed the behavioral changes you describe.
Thus, you must have either changed:
ISA settings
IE settings
What you don't state is:
- ISA edition; SE or EE?
- ISA patches; what SP / rollup level are you running?
- IE configuration:
- what defaults have you changed?
- have you used the very-useful "reset " button (Tools, Internet Options,
Advanced, "Reset" button)?
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Chris Addicks
Sent: Friday, November 10, 2006 12:20 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
I do not have the "require all users to authenticate" checked. I prefer to
specify the authentication in the individual rules since we have some
specific client programs that we are required to use that will not provide
authentication, so for those destinations and protocols only, I allow
non-authenticated traffic through. If I checked the box, like Thor, then
these clients would fail.
One thing to point out. I did not have this problem with the final RC of
IE7. It only occurred when I loaded the released version. We also get the
username/password box occasionally even with IE6, but supplying the info
clears it.
Chris
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Thor (Hammer of God)
Sent: Friday, November 10, 2006 2:46 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
Except that anonymous access will still be possible. I require all users to
authenticate at the listener and have not had any issues like this at all.
t
----- Original Message -----
From: "Mark Morgan" <MMorgan@xxxxxxxxxxxxxxxxxxxxx>
To: <isalist@xxxxxxxxxxxxx>
Sent: Friday, November 10, 2006 11:35 AM
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
Uncheck "require all users to authenticate" on the ISA, it will still
authenticate and your problem should go away.
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On
Behalf Of Chris Addicks
Sent: Friday, November 10, 2006 11:03 AM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
Ara,
I just restarted the whole server and still no luck. I monitored the
traffic from my pc on the firewall, and it is failing my general internet
access rule because my pc is not sending user credentials and appears to be
only trying to access the internet as an anonymous user.
Chris
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Ara Avvali
Sent: Friday, November 10, 2006 12:12 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
Do you think you can restart firewall service? There will be a shortage but
it may help. Sometimes it happens to me and this is the only way I can get
it go away. Actually it happens after restarting the PDC
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Chris Addicks
Sent: Friday, November 10, 2006 9:06 AM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
Steve,
I just checked and integrated authentication is enabled. I tried loading it
on another machine, and still no luck. I think it must be something on the
ISA server, that is where the username and password box is coming from.
I
just can't figure it out.
Chris
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Steve Moffat
Sent: Friday, November 10, 2006 8:19 AM
To: ISA Mailing List
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
It's not an IE 7 issue, I have just finished a 500 user rollout with no
IE7 / ISA issues.
Is integrated authentication enabled in IE7 properties?
S
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Chris Addicks
Sent: Friday, November 10, 2006 9:03 AM
To: ISA Mailing List
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
Roland,
Sorry for being dense, but I don't know what you mean by the "section
checked passwords". If you mean the checkbox to remember passwords, I have
tried it both checked and unchecked. I have also entered my username in all
the forms I could think of: domain\username, username@xxxxxxxxxxxx,
domain.local\username, etc. I have since unloaded IE7 so I could function,
but it strikes me as odd that it should have problems with Microsoft's own
firewall product.
Chris
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Mueller, Roland
Sent: Thursday, November 09, 2006 1:55 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Re: Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
I would research the section "cheched passwords" on the requesting client.
Roland
-----Original Message-----
From: isalist-bounce@xxxxxxxxxxxxx [mailto:isalist-bounce@xxxxxxxxxxxxx]
On Behalf Of Chris Addicks
Sent: Tuesday, November 07, 2006 3:35 PM
To: isalist@xxxxxxxxxxxxx
Subject: [isalist] Internet Explorer 7 password prompt won't work
http://www.ISAserver.org
-------------------------------------------------------
We have been using ISA 2004 for some time now with no problems. We have
configured it to require user authentication for access to the internet from
our internal network. I have been using IE7 Beta with no real problems, but
when I loaded the IE7 production release, I am prompted for a username and
password by the isa server, and no matter how I enter it, I cannot get
through the firewall. I have also tried to load IE7 on another machine, one
that has not had the IE 7 beta, and it does the same thing. Anyone know
what is going on here, I am sure it is just something I am missing?
Thanks
in advance, and my apologies if this has already been covered. I tried to
find info on the isaserver.org site, but couldn't.
Chris
All mail to and from this domain is GFI-scanned.
------------------------------------------------------
List Archives: //www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials:
http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: //www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials:
http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx
All mail to and from this domain is GFI-scanned.
------------------------------------------------------
List Archives: //www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials:
http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: //www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials:
http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx
All mail to and from this domain is GFI-scanned.
------------------------------------------------------
List Archives: //www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials:
http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: //www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials:
http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx
All mail to and from this domain is GFI-scanned.
------------------------------------------------------
List Archives: //www.freelists.org/archives/isalist/
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server Articles and Tutorials:
http://www.isaserver.org/articles_tutorials/
ISA Server Blogs: http://blogs.isaserver.org/
------------------------------------------------------
Visit TechGenix.com for more information about our other sites:
http://www.techgenix.com
------------------------------------------------------
To unsubscribe visit http://www.isaserver.org/pages/isalist.asp
Report abuse to listadmin@xxxxxxxxxxxxx
Other related posts:
