Products

Solutions

Resources

Partners

Community

Blog

About

QA

Ideas Test

New Community Website

Ordinarily, you'd be at the right spot, but we've recently launched a brand new community website... For the community, by the community.

Yay... Take Me to the Community!

Welcome to the DNN Community Forums, your preferred source of online community support for all things related to DNN.
In order to participate you must be a registered DNNizen

HomeHomeDNN Open Source...DNN Open Source...Provider and Extension ForumsProvider and Extension ForumsAuthenticationAuthenticationSome issues using AD (Firefox prompts password, Admin gets Some issues using AD (Firefox prompts password, Admin gets 'Access Denied', User get wrong rights)
Previous
 
Next
New Post
3/3/2009 2:03 AM
 

I am running DNN on a remote development server where are developing a new Intranet. I successfully installed the new AD provider with DNN getting all green "OK" in the AuthenticationProvider section of the extension menu. I also changed the IIS settings as described and added a new portal alias in the Host to gain access from other computers than localhost. I even added the site to the Intranet Zone of my local computer.

Anyways, there still occure the following issues:

- When trying to access the site with Firefox instead of Internet Explorer, I still get asked for username and password where I have to enter the same credentials used to access the remote virtual desktop. Obviously this is not acceptable for an Intranet, where many employees would like to use Firefox.

- Even adding out site to the Intranet Zone of IE, it would not be possible to do this on every of our employees computers (300+), we even do not want to instruct them to do it theirself. Isn't there a more automatic/central solution to get AD integration working?

- When accessing DNN from my local computer with IE (so no Firefox prompt), it seems that AD integration works, as my local username appears in the user list of DNN (as Domain\Username). The username is also added to the "Registered Users" security role. Anyways, I only can see a blank page and the "home" link (and the "login" link at the top) although all sites are set to be accessable for the "Registered users" role.

- When manually login in as the standard pre-defined "admin" I also cannot see the pages I created, but only the Admin menu. But even there when clicking to the pages-tab and trying to edit a page, I get an "Access Denied You do not have access to view this module within the portal." error.

The page permissions I set as follows:

  View Page Edit Page
Administrators

Permission Granted

(Lock symbol)

Permission Granted

(Lock symbol)

All Users

Permission Denied

(cross symbol)

Permission Denied

(cross symbol)

Registered Users

Permission Granted

(OK symbol)

Permission Denied

(OK symbol)

Unauthenticated Users

Permission Denied

(cross symbol)

Permission Denied

(cross symbol)

 
New Post
3/3/2009 10:53 AM
 

Firefox does prompt for the username/password and there's nothing I can do about that. It's how Firefox talks to your IIS server and is outside the control of DNN.

As far as adding the site to the Trusted or Intranet zones....again this is outside the scope of DNN or the provider. In order for the user's credentials to be automatically pulled into IIS without the popup the site has to be in one of those zones. Group Policy works great for adding the site to either of those zones.

It's odd that you're getting that error on page permissions. Once the account is in DNN it's no different than any other DNN user account so I suspect you'd be having the problem even without the AD provider installed. I know this is a development server but is it accessible outside of your intranet?

 
New Post
3/3/2009 10:36 PM
 

Mike Horton wrote

Firefox does prompt for the username/password and there's nothing I can do about that. It's how Firefox talks to your IIS server and is outside the control of DNN.

Well, so we have to live with that. Fortunately (actually UNfortunately), the actual corporate policy is to use IE6, so most of the users still use that browser.

As far as adding the site to the Trusted or Intranet zones....again this is outside the scope of DNN or the provider. In order for the user's credentials to be automatically pulled into IIS without the popup the site has to be in one of those zones. Group Policy works great for adding the site to either of those zones.

So the only automized or centralized way will be to add a group policy which adds our intranet to the that zone? In the AD Provider User's Guide I read about configuring the web.config and then leading users to the WindowsSignin.aspx - would that be a better solution?

It's odd that you're getting that error on page permissions. Once the account is in DNN it's no different than any other DNN user account so I suspect you'd be having the problem even without the AD provider installed. I know this is a development server but is it accessible outside of your intranet?

I found it, the issue was NOT AD-related. Obviously, setting "All users -- view page: denied -- edit page: denied" will override

  • "Registered users -- view page: allow -- edit page: denied" and
  • "Administrators -- view page: allowed -- edit page: allowed".

Furthermore even "Registered users -- view page: allow -- edit page: denied" will override

  • "Administrators -- view page: allowed -- edit page: allowed"

So I set the permission to the following and it works (but can anyone confirm this? especially regarding the second that the "Registered user: edit page: denied" will override an "Administrators: edit page: allowed"?)

 

  View Page Edit Page
Administrators Permission Granted Permission Granted
All Users Not Specified Not Specified
ggTH_STUDENT Not Specified Not Specified
Registered Users Permission Granted Not Specified
Unauthenticated Users Permission Denied Permission Denied

 

 
New Post
3/4/2009 5:46 PM
 

Jens Lemmer wrote
 

 As far as adding the site to the Trusted or Intranet zones....again this is outside the scope of DNN or the provider. In order for the user's credentials to be automatically pulled into IIS without the popup the site has to be in one of those zones. Group Policy works great for adding the site to either of those zones.

 

So the only automized or centralized way will be to add a group policy which adds our intranet to the that zone? In the AD Provider User's Guide I read about configuring the web.config and then leading users to the WindowsSignin.aspx - would that be a better solution?

It's the automatic redirection to WindowsSignin.aspx that's causing the pop-up that you're seeing now. Manually leading users to the page is still going to bring up the pop-up if the site isn't in their Intranet/Trusted Sites list.

I don't know if using group policy is the only way but it's certainly one of the easiest. Another option may be as part of a login script if you're using one.

 
New Post
3/4/2009 11:35 PM
 

Mike Horton wrote

I don't know if using group policy is the only way but it's certainly one of the easiest. Another option may be as part of a login script if you're using one.

I think we use one, but as this is not my area, may I ask you to provide some more information on the login script (and maybe how to do it) so I can adress that more specifically to the IT guys responsible for that?

 
Previous
 
Next
HomeHomeDNN Open Source...DNN Open Source...Provider and Extension ForumsProvider and Extension ForumsAuthenticationAuthenticationSome issues using AD (Firefox prompts password, Admin gets Some issues using AD (Firefox prompts password, Admin gets 'Access Denied', User get wrong rights)


These Forums are dedicated to discussion of DNN Platform and Evoq Solutions.

For the benefit of the community and to protect the integrity of the ecosystem, please observe the following posting guidelines:

  1. No Advertising. This includes promotion of commercial and non-commercial products or services which are not directly related to DNN.
  2. No vendor trolling / poaching. If someone posts about a vendor issue, allow the vendor or other customers to respond. Any post that looks like trolling / poaching will be removed.
  3. Discussion or promotion of DNN Platform product releases under a different brand name are strictly prohibited.
  4. No Flaming or Trolling.
  5. No Profanity, Racism, or Prejudice.
  6. Site Moderators have the final word on approving / removing a thread or post or comment.
  7. English language posting only, please.
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out
What is Liquid Content?
Find Out