How to properly setup Active Directory authentication using LDAPLogin.aspx?

Question

I've setup the Active Directory module (1.3) and the final step that I can't quite figure out is how to get the ldaplogin.aspx page to work without prompting for credentials.

Checklist:

• Windows Authentication configured for ldaplogin.aspx. Anonymous disabled.
• Application running using a service account demo\service.scTST.
• User accounts are properly coming from Active Directory and I can login to /sitecore/login with the same account receiving the prompt.

Am I missing the Service Principal Name (SPN)? How is that properly done in this scenario?

Update

With newer versions of Sitecore (8.2+), the authentication section in the Web.config sets the mode to Forms. Double check that when trying to set the authentication settings through IIS. You may see that Forms can't be disabled. Simply set the mode to None and then you can change it. The single sign-on works through IE, just not Chrome.

Regarding the SPN, we set it on the service account but does not appear to make a difference in this case.

http/servername
http/servername.company.name

Update 2019-03-09

Discovered in Chrome that a policy needs to be applied for the Auto Logon feature to work. Check out chrome://policy to see which ones are currently applied.

In my example, by editing the AuthNegotiateDelegateWhitelist from within the registry and restarting the browser authentication appeared to work. I updated AuthServerWhitelist for extra measure.

Registry path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome

• AuthNegotiateDelegateWhitelist : companyname.com,othercompanyname.com
• AuthServerWhitelist : companyname.com,othercompanyname.com

Answer 1

This behavior is seen if the custom host header that you use does not match the local computer name. We had the same issue where despite providing the right credentials in the window prompt, we were gettung HTTP Error 401.2 - Unauthorized. (you may get HTTP Error 401.1 too!)

For enabling SSO, the Sitecore Support pointed me to an article at https://sdn.sitecore.net/Scrapbook/401,-d-,1%20Error.aspx

Basically in the article, the resolution steps are outlined here : https://support.microsoft.com/en-us/help/896861/you-receive-error-401-1-when-you-browse-a-web-site-that-uses-integrate

I was able to enable SSO using Method 1: Specify host names (Preferred method if NTLM authentication is desired) outlined in the above link.

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
3. Right-click MSV1_0, point to New, and then click Multi-String Value.
4. Type BackConnectionHostNames, and then press ENTER.
5. Right-click BackConnectionHostNames, and then click Modify.
6. In the Value data box, type the host name or the host names for the sites that are on the local computer (list each host names in the new line!), and then click OK.
7. Quit Registry Editor, and then restart the IISAdmin service.

After you do this and hit LDAPlogin.aspx once again, you will be prompted to enter the credentials. However once you provide the right credentials and are authenticated, hitting LDAPLogin.aspx subsequently will not prompt for credentials.

However, in order to make this annoying window pop-up disappear even for the very first time, you should add the host names to the list of "Local intranet sites" in IE.

Hope this helps someone who experiences similar problem as ours!