up vote 0 down vote favorite
share [g+] share [fb]

I'm using mod_auth_sspi with Apache on Windows Server 2008. SSO works fine on IE if I use the NetBIOS name of the computer, say serv1 (or serv1.domain.com) . But if I use a different FQDN it does not work, (say serv2 or serv2.domain.com - pointing via DNS to same IP).

The FQDN points to the right IP - I've checked with nslookup, and of course other sites without SSO on the same FQDN work.

The SSO works fine with the NetBIOS name. With the FQDN serv2 it asks for username/password.

I've tried putting serv2 in Trusted Sites and in Intranet - it asked for password in both.

I've tried adding the 'LM & NTLM responses' in Local Security policy - it still asks for password.

Same setup of Apache/SSPI works at a different site.

What am I missing?

link|improve this question
SSPI normally uses Kerberos, not NTLM (and enabling old LM can introduce security issues). Check with a packet monitor such as Wireshark or Network Monitor if IE is using the correct principal name in the Kerberos requests and whether the requested name exists in Active Directory. If not, you'll need to add it with setspn, IIRC. – grawity Jan 12 at 8:05
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.