Internet Explorer and authentication

A former student (let's call him Joe) sent me mail the other day. He was wondering why sometimes when he surfs to an internal website he is prompted for credentials, when the site is configured for integrated authentication. “Shouldn't it just happen automatically?” he asked. Apparently after he types in his Windows user name and password (the same account he's logged in with, by the way), things work great.

If you ever see one of those popups and you're surprised like Joe was, glance down at the status bar (you may have to turn the stupid thing on again if it's been turned off on you, but that's another post). Look and see what zone that website is in. If it's the Internet zone, you're most likely just running into a security feature that IE implements to help protect your anonymity when surfing the web.

Bring up the Internet Options dialog and flip to the Security tab. Select the Internet zone, then press “Custom Level...” to see the details of the protections IE provides you when surfing Internet sites. If you scroll down a bit, you'll probably see something like this:

So why would a website inside of Joe's company be lumped in the “Internet” zone? Probably because Joe accessed it via a DNS name that had a dot in it (for example, http://www.pluralsight.com or http://192.168.0.22 as opposed to http://webbox). This is one heuristic that IE uses to figure out what's probably not in the “Local Intranet” zone. Anything that cannot be categorized in any other zone is automatically dropped into the Internet zone for safety sake.

If you have an internal website that use a lot and want to avoid being prompted for credentials, simply tell IE that this site should be considered part of the Local Intranet zone. You can do this by going to back to the Security tab and selecting the Local Intranet zone then pressing the “Sites...” button. If you look at the security settings for the Local Intranet zone, you'll see that it will automatically log you in without a prompt (of course if the website is using Basic authentication, this isn't possible because the website needs your cleartext password and you'll still be prompted).

For external websites that you trust, you can also add them to the “Trusted Sites” zone in the same fashion.