Crazy IE Bug

Wednesday, March 15, 2006This one was really frustrating. The behavior seemed bizarre, some people could login, some people couldn't.

Here's the situation:

  1. Using Internet Explorer,
  2. on a Kerberos-enabled Windows domain,
  3. access a website that is
  4. specified in the trusted sites zone, and
  5. Enable Integrated Windows Authentication is checked.
Two things break in this situation:
  1. Trying to access the site over standard HTTP instead of HTTPS (i.e., not over SSL), results in a Server Not Found error - DNS error
  2. Once on an SSL connection, form data simply will not POST (The POST Method Does not Work if You are using Kerberos Authentication)
Both problems are related to IE trying to authenticate using Kerberos.
  1. When not in SSL-mode, IE can't (or won't) connect to the Kerberos server, which is actually the server not found. The problem is that our solution needed to allow people to connect either way, and then be redirected to SSL. However, whether SSL or not, the user has to be authenticated first, which this bug prevented when not in SSL mode.
  2. Then the user gets an additional login form, which mind-bogglingly just does nothing!
Turn off Enable Integrated Windows Authentication in Internet Explorer and both these problems go away. What happens is that IE and IIS authenticate with NTLM instead of Kerberos, and all is well. It's possible that disabling Kerberos in IIS could make this a moot point, too, but I haven't tested that.

1 Comment