MOSS 2007 credentialing weirdness (prompting)

[damenk]

Ok, we've got a MOSS 2007 environment, with Office 2007 and XP clients (with a combination of IE6 and IE7).
We've (in the last week) started running into some very strange credential issues. We use integrated authentication with kerberos.

Weirdness #1:
For some of our users (and only some of our users), they will be randomly prompted for credentials, even though they are logged in and may have been accessing the site successfully for some time. The system will refuse to accept any credentials they then try to present, eventually locking them out. These users are not doing anything out of the ordinary when this happens.

Weirdness #2:
A user will attempt to edit an uploaded file. Word will launch. The address of the file (in the small window that appears) will suddenly change from http to https, and they will be prompted for a certificate. If they go ahead and pick their cert and enter their pin, the file path changes back to http and the file loads successfully. This only seems to happen to some users, and the path as specified in the sharepoint window is http.

Anyone have any ideas? I've been going crazy. Thanks.

Damen Knight
MCSE: 2003, MCSA: 2003, Security+

 

[ThaPCdoc]

Sounds like you have client cert mapping selected in IIS. Is this what you want? Also, I've found that my users have to enter their domain credentials when logging in. DOMAIN\bob or bob@domain.com.

Firefox doesn't care, but MS Office products rely on domain authentication. This problem went away for me when I selected Integrated Windows Auth and Digest Auth in IIS.

 

[damenk]

we have ~1200 users. These issues are happening to ~5-10 (not percent, 5-10 users). That makes me very suspicious about it being a server-side problem, to be honest...

I just checked; we do not have client cert mapping selected, we have it set up for Integrated Windows Auth.

Damen Knight
MCSE: 2003, MCSA: 2003, Security+

 

[JBalcer]

Check the specific user permissions in that specific site. This usually happens when there is lack of user permissions on the specific site