If you're like me, you have created a few web pages/sites in your time. Some, if not most, of these require some level of authentication (be it Forms Authentication or Windows Authentication (Integrated Security)). Oftentimes, the website you create resides on the local machine and you can simply browse to it via http://localhost, but such is not always the case. You may have been occasionally perplexed that when you use Windows Authentication that the browser (Internet Explorer) will prompt you for your user name and password.
Shouldn't it already know who you are, since you're already authenticated to the domain? Well, the answer is yes, it knows who you are, but it doesn't care in certain circumstances.
If you browse to http://localhost or http://MyComputerName to a website using Integrated Security, IE will automatically provide credentials to the webserver and thereby not prompt you. However, if you use the FQN (Fully Qualified Name) of your machine (e.g. http://MyComputerName.Domain.local), IE will prompt for a password - even though it's the same machine, the local machine no less. The primary reason behind this is the punctuation...period
. In fact, IE will consider dotted URLs (those that contain periods) to exist in the internet zone. Because that zone is more hazardous and less trusted than the intranet zone, credentials are not automatically provided.
You can circumvent this issue by adding the URL to the Intranet Zone:
- Click Tools -> Internet Options
- Select the Security tab
- Select Local Intranet and click the Sites button
- Click Advanced
- Add the FQ URL (e.g. http://MyComputerName.Domain.local)
There are other factors to consider besides just the dotted name.
- The browser must be IE (duh, it's the only browser that supports Windows Integrated Security)
- The site must be set up for Integrated Security (if anonymous is enabled, Integrated Security will have no effect)
- Automatic logon only in Intranet zone must be enabled
For more details, check out the Microsoft documentation. This took me a long time to find. I have long suspected that the periods in the name were causing the issue, but had never seen this documented until a few days ago. Anyway, it's good information to know.