3

I've setup the Active Directory module (1.3) and the final step that I can't quite figure out is how to get the ldaplogin.aspx page to work without prompting for credentials.

Checklist:

  • Windows Authentication configured for ldaplogin.aspx. Anonymous disabled.
  • Application running using a service account demo\service.scTST.
  • User accounts are properly coming from Active Directory and I can login to /sitecore/login with the same account receiving the prompt.

Am I missing the Service Principal Name (SPN)? How is that properly done in this scenario?

Error logging in

Update

With newer versions of Sitecore (8.2+), the authentication section in the Web.config sets the mode to Forms. Double check that when trying to set the authentication settings through IIS. You may see that Forms can't be disabled. Simply set the mode to None and then you can change it. The single sign-on works through IE, just not Chrome.

Regarding the SPN, we set it on the service account but does not appear to make a difference in this case.

http/servername
http/servername.company.name

Update 2019-03-09

Discovered in Chrome that a policy needs to be applied for the Auto Logon feature to work. Check out chrome://policy to see which ones are currently applied.

In my example, by editing the AuthNegotiateDelegateWhitelist from within the registry and restarting the browser authentication appeared to work. I updated AuthServerWhitelist for extra measure.

Registry path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome

  • AuthNegotiateDelegateWhitelist : companyname.com,othercompanyname.com
  • AuthServerWhitelist : companyname.com,othercompanyname.com
  • When you are logged in into Sitecore with an admin account, do you see the roles and users coming from the AD? You didn't forget to add the ad domain to domains.config? After all configuration was done properly, we had to apply this patch to be able to login: kb.sitecore.net/articles/520134 – Koen Heye Apr 5 '17 at 5:39
  • 1
    Are you trying via chrome?` For Chrome, please have a look at this page and note where it states dev.chromium.org/developers/design-documents/… Some services require delegation of the users identity (for example, an IIS server accessing a MSSQL database). By default, Chrome does not allow this. You can specify --auth-negotiate-delegate-whitelist to enable it for the servers. Not sure if you are able to do it via chrome – Thomas Bæk Apr 5 '17 at 9:10
  • I think to avoid the login prompt you may need to write log in pipeline override and create a custom login page, you may use the existing sitecore login page but upon submit you can call your custom pipeline as well to redirect them to login screen. – Mrunal Daftari Apr 6 '17 at 16:10
4

This behavior is seen if the custom host header that you use does not match the local computer name. We had the same issue where despite providing the right credentials in the window prompt, we were gettung HTTP Error 401.2 - Unauthorized. (you may get HTTP Error 401.1 too!)

For enabling SSO, the Sitecore Support pointed me to an article at https://sdn.sitecore.net/Scrapbook/401,-d-,1%20Error.aspx

Basically in the article, the resolution steps are outlined here : https://support.microsoft.com/en-us/help/896861/you-receive-error-401-1-when-you-browse-a-web-site-that-uses-integrate

I was able to enable SSO using Method 1: Specify host names (Preferred method if NTLM authentication is desired) outlined in the above link.

  1. Click Start, click Run, type regedit, and then click OK.
  2. In Registry Editor, locate and then click the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
  3. Right-click MSV1_0, point to New, and then click Multi-String Value.
  4. Type BackConnectionHostNames, and then press ENTER.
  5. Right-click BackConnectionHostNames, and then click Modify.
  6. In the Value data box, type the host name or the host names for the sites that are on the local computer (list each host names in the new line!), and then click OK.
  7. Quit Registry Editor, and then restart the IISAdmin service.

After you do this and hit LDAPlogin.aspx once again, you will be prompted to enter the credentials. However once you provide the right credentials and are authenticated, hitting LDAPLogin.aspx subsequently will not prompt for credentials.

However, in order to make this annoying window pop-up disappear even for the very first time, you should add the host names to the list of "Local intranet sites" in IE. enter image description here

Hope this helps someone who experiences similar problem as ours!

  • Hi, and welcome to Sitecore Stack Exchange :-) Our mission is to document questions and answers - and your answer has a problem in that, it relies on links. If I were to take out the links, the answer would hold no value on it's own. Please refer to sitecore.stackexchange.com/help/how-to-answer – Mark Cassidy Sep 18 '17 at 12:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.