IE8 Windows Security domain problem - Firefox works

[tjp63]

Hi,

New here, but thought this might be a good place to start. I've noticed some similar discussions here and tried searching, but didn't find an answer to my problem.

I'm hosting a couple of web sites at a web hotel. Some are Unix-based, some are Windows-based. The web hotel naturally offers a statistics-service. The Unix-based hotels show statistics properly without any problems. The Windows-based hotels, on the other hand...

When I try to view them, I go to nameofmywebsite.net/stats. I'm currently using Win7/IE8. With Vista/IE7, there was no problems, but now the "Windows Security" pop-up appears, asking for the user name and password.

As you know, the default domain seems to be the name of the computer. In this case TJPDT. So I've tried to access the domain with nameofmywebsite.net\username which does change the domain, but the pop-up keeps appearing until there comes the page telling me I don't have the credentials to view the site.

I've tried to reset IE-settings, lowered security settings etc... No luck. However, when I try to access the stats with Firefox, the thing works. Firefox just brings up a pop-up and asks me for the username and password for nameofmywebsite.net and there's no mention of my computer's name as the domain anywhere.

So my guess is that IE just doesn't send the user name and password properly to my web hotel. I'm now getting the pop-up that has the proper domain name at the top "Connecting to nameofmywebsite.net", but the user name is still nameofmywebsite\username and there seems to be no way of changing that. If I try to use another credentials, the domain defaults back to TJPDT.

And yes, I have typed the user name and password manually, not used copy/paste (a problem I came across while searching for an answer).

While this is not a huge thing since I can use Firefox to check the stats, any suggestions would be greatly appreciated.

 

[cluberti]

The web hotel - what kind of authentication is it requiring, and what formats are valid? You may be able to use .\user as the user name, with the password, or user@domain as the username. You might want to check with their support, or get a network trace using Vista working and see what type of challenge / auth is being used.

 

[tjp63]

No idea on the authentication required. I just know that if I hit "cancel" on the Windows Security pop-up, the following error occurs:

--
You do not have permission to view this directory or page due to the access control list (ACL) that is configured for this resource on the Web server.
--

I'm trying to access the statistics via the web hotel's control panel. It doesn't seem to work at all if trying to access it directly (that is, going directly to nameofmywebsite.net/stats).

.\user doesn't work since it leaves TJPDT as the domain. user@domain does change the domain but the result is the same as using domain\user. The pop-up just appears again.

I have an on-going conversation with the web hotel's support. They asked me to try with Firefox and, as I mentioned, it worked. They should contact me again tomorrow so we'll see what happens.

It does, however, appear, that for some reason, IE just doesn't forward the user name and password properly to the web hotel. And my guess is that is has to do with the fact that the domain defaults to TJPDT.

 

[cluberti]

If this isn't using SSL, you can just get a network trace of the login and see what authentication they're using (and if it's digest, basic, or NTLM, you can see the format of the user/domain too).

 

[tjp63]

Never done a network trace before, but I did one now with Wireshark. Found the part where I should login to the stats page. The authentication appears to be NTLM. Domain name appears to be correct, as is the user name. Host name is my computer's name, TJPDT. No mention of password anywhere, however.

I searched for a string (my password) from the log and only got a hit from the part where I logged in to the web hotel's control panel.

Again, I'm new at this, so I don't know if the password to the stats should even be visible there or encrypted, but it doesn't show anywhere.

I'm gonna try the same thing with Firefox (that does show the stats properly) and see what it sends.