Integrated Windows Authentication browser requirements

If you have problems with IWA, verify the following:

• For all types of browsers

  • Use the hostname of the server instead of the IP address

  • Use https, make sure the server's certificate is trusted by the browser

  • Add the URL to Local intranet zone in IE even if you use Chrome or Firefox
    AD SSO might not work if Internet Explorer does not consider the server as a Local Intranet site. Make sure you add your service domain URL (e.g. verba.company.com) to the Local intranet zone in Internet Explorer.

    Go to Tools > Internet Options > Security
    Select the Local intranet icon and click Sites
    Click Advanced and add the URL of the server (for example: http://verbaserver.com).

• Internet Explorer

  • Strange error pages with HTTP Status 401
    Internet Explorer users may occasionally receive strange error pages after logged in to Verba using Single Sign On. Unfortunately, the cause of the issue is an Internet Explorer feature and can be solved on the client computer only. Microsoft has confirmed that this is a problem with the Microsoft products.
    The only workaround currently is to disable NTLM Pre-Authentication on the client computer:

    Use Registry Editor (Regedt32.exe) to add a value to the following registry key: HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Internet Settings/

    Add the following registry value:

    Value Name: DisableNTLMPreAuth

    Data Type: REG_DWORD

    Value: 1

    A description and the same workaround from Microsoft can be read here: http://support.microsoft.com/kb/2749007 

  • Ensure that "Enable Integrated Windows Authentication" is checked (by default it is).
    Go to Tools > Internet Options > Advanced
    Scroll down to the Security section
    Find "Enable Integrated Windows Authentication" and ensure that it is checked.

• Firefox

  • If SSO does not work (ie. an unexpected login box appears, or HTTP 401 error comes up), probably the Verba server has to be added to the trusted SSO servers.
    At the address field, type about:config
    In the Filter, type network.n
    Double click on network.negotiate-auth.trusted-uris
    This preference lists the sites that are permitted to engage in SPNEGO Authentication with the browser
    Enter a comma-delimited list of trusted domains or URLs (for example: http://verbaserver.com).

• Chrome

  • Everything should work properly without any further configuration.