[CentOS] IE 9 not sending digest auth info

[Keith Roberts]

On Tue, 23 Aug 2011, Paul Heinlein wrote:

> To: CentOS <centos at centos.org>
> From: Paul Heinlein <heinlein at madboa.com>
> Subject: [CentOS] IE 9 not sending digest auth info
> 
> I migrated our internal wiki server last week, and some IE users
> aren't able to authenticate.

If it's only *some* IE users, you could try checking the 
internet preferences for those that can authenticate and 
those that cannot authenticate. Maybe that would throw some 
light onto this?

The other thing I'd be inclined to test is this: Install 
Wireshark on a machine that can authenticate using IE, and 
on another that CANNOT authenticate. Then watch the 
responses as the packets flow, and see if there is a 
difference between IE users that can authenticate, and those 
that cannot.

> The service is hosted by Apache using Digest authentication. It
> migrated from Apache 2.2.9 (Debian 5) to Apache 2.2.15 (CentOS 6). The
> internal hostname for the wiki server is a DNS CNAME that was
> repointed from one host to another during the cutover.
>
> In a normal session,
>
> 1. Client sends GET
> 2. Server sends 401 with WWW-Authenticate header
> 3. Client sends GET with Authorization header
> 4. Server sends 200 with Authentication-Info header and page content
>
> When using IE 9 (and possibly 8, I'm still trying to track that down),
>
> 1. Client sends GET
> 2. Server sends 401 with WWW-Authenticate header
> 3. Client resends GET (*without* Authorization header)
> 4. Server sends 401 with WWW-Authenticate header
> 5. Etc.
>
> IE seems to be ignoring 401 and/or the WWW-Authenticate headers. Using
> Chrome on Windows works fine; the issues are specific to IE.
>
> Any ideas?

You could try to convice the IE users that have 
authentication problems to dump IE and install Firefox 
instead?

Kind Regards,

Keith Roberts

-----------------------------------------------------------------
Websites:
http://www.karsites.net
http://www.php-debuggers.net
http://www.raised-from-the-dead.org.uk

All email addresses are challenge-response protected with
TMDA [http://tmda.net]
-----------------------------------------------------------------