If users visit a Web site that requires authentication, they may be repeatedly prompted to provide their credentials. This symptom occurs even after the users type valid credentials.

Back to the top

This issue occurs if either of the following conditions are true:

•

The published Web server requires Kerberos authentication.

•

The published Web server and the Microsoft Internet Security and Acceleration (ISA) Server-based computer both have Windows integrated authentication enabled, and both require authentication. This condition may occur in a reverse scenario where ISA Server uses the same HTTP headers for authentication that are used by the Web server. When a user accesses ISA Server, they are prompted for credentials. After ISA Server accepts the credentials, ISA Server forwards the request without the credentials to the published Web site. This causes the Web site to also prompt the user for authentication. These multiple authentication requests cause the Web browser to interpret that the credentials are incorrect. Therefore, the user is prompted again for credentials. Users may be prompted to type credentials many times if the Web browser opens several connections.

Back to the top

To resolve this issue, use one of the following methods.

Back to the top

Method 1

Enable NTLM authentication only or enable both Kerberos and NTLM authentication on the published Web site and then publish the Web server in ISA Server.

For more information about how to do this, click the following article numbers to view the articles in the Microsoft Knowledge Base: For additional information about how to publish Web servers in ISA Server, visit the following Microsoft Web site:

Back to the top

Method 2

Enable only Basic authentication on both the published Web site and on the corresponding Web listener on the ISA Server computer. To do this, follow these steps:
Warning This workaround may make your computer or your network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.Note Because user credentials are sent by plain text in basic authentication, we recommend that you create a secure Web publishing rule in ISA Server to help make traffic more secure. You can also use SSL along with this workaround so that the authentication is not in clear text. For more information, see the "Secure Web Publishing rules" topic in the ISA Server Help documentation.

1.	Enable only Basic authentication on the published Web site.
2.	Enable only Basic authentication on the corresponding Web listener in ISA Server. To do this, follow these steps: a. Start the ISA Server Management tool. b. Expand the ISA Server-based computer node, and then click Firewall Policy. c. In the Details pane, click the corresponding Web publishing rule. d. On the Tasks tab, click Edit Selected Rule. e. On the Listener tab, click the Web listener, and then click Properties. f. On the Preferences tab, click Authentication, click to select the Basic check box, and then click OK three times. Notes • For ISA Server 2006, click the Authentication tab, click HTTP Authentication in the Method clients use to authenticate to ISA Server list, and then click the Basic check box. • Click Yes if you receive a message that states that passwords will be sent without data encryption.
3.	Enable Basic Delegation on the corresponding Web publishing rule on the ISA Server computer. To do this, follow these steps: a. Start the ISA Server Management tool if it is not already started. b. Expand the ISA Server-based computer node, and then click Firewall Policy. c. In the Details pane, click the corresponding Web publishing rule. d. On the Tasks tab, click Edit Selected Rule. e. On the Users tab, click to select the Forward Basic authentication credentials (Basic delegation) check box, and then click OK. Note For ISA Server 2006, click the Authentication Delegation tab, select Basic authentication in the Method used by ISA Server to authenticate to the published Web Server list , and then click OK. The Basic Authentication option is available only if you have selected HTTP Authentication or HTML Form Authentication in the Listener tab

Back to the top