266580 - Suppress multiple prompts for "Integrated Windows authentication".

Status: RESOLVED WORKSFORME

(Core :: Networking, defect)

Description

[Andy Townsend]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.0; rv:1.7.3) Gecko/20040913 Firefox/0.10.1
Build Identifier: Firefox 0.10 RC1

The scenario:

There's a web set running IIS5 with the following authentication settings on a
directory from whcih something must be loaded:

o Enable anonymous access (set)
o Basic auth (password is sent in clear text) (unset)
o Digest auth for Windows domain servers (greyed out, unsettable)
o Integrated Windows auth (set)

On a Windows 2000 PC, you visit that web site in IE - you get no prompts because
of the "bit of magic behind the scenes" that was noted in bug 231529.

Next, visit that web site in Firefox 0.10 RC1 - you get an authentication prompt.  
Hit the escape key - don't enter a password.
The page behind loads fine, because "anonymous access" is allowed by IIS.
Follow a link to another page.
Some items on this new page have the same authentication settings as described
above.
Another authentication prompt appears.
Again, hit the escape key - don't enter a password.
Follow a link, and the process repeats - you either enter the correct password
or press escape every page.


The problem:
What "should" happen here has been discussed widely in a number of related bugs
(should NTLM authentication reprompt and retry, or failover - discussed in bug
226456).  Surely what needs to happen is to put control in the hands of the user
- there should be some way of saying "don't bug me again this session for this
site".  There are the "about:config" auth settings; but they don't really solve
the problem and certainly aren't accessible while there is a userid / password
dialogue box on the screen.


Reproducible: Always
Steps to Reproduce:
1. Set up an IIS web site with the authentication as described in "details"
2. Point Firefox 0.10 RC1 at it and follow the instructions in "details"

Actual Results:  
You keep getting prompted for authorisation.

Expected Results:  
There should be some way of saying "don't bug me again this session for this site".

See also bug 115500 ("Password Dialog should display type of auth") and 259854 
 (which masked the presence of this issue until it was fixed in RC1).

Arguably this bug and bug 115500 should be merged together with a fix giving the
user more info and more control over the procedure.

Comment 1

[Andy Townsend]

This appears to be fixed in the released "Firefox 1.0".  Many thanks.

Comment 2

[Matthias Versen [:Matti]]

no patch = not fixed

Comment 3

[Matthias Versen [:Matti]]

-> wfm