SharePoint University

I've got MOSS 2007 set up in a farm configuration. The web server and SQL server are on separate virtual machines. I have it configured to use Negotiate (Kerberos) authentication.

Whenever someone goes to the Sharepoint address they are automatically logged into the user account they are signed onto the computer as (this is good). They can browse, create content, download files and all the sharepoint stuff. However at some random interval they'll get a login prompt pop up. If you put in your credentials it doesn't accept, the prompt keeps coming up. Even the administrator account can't seem to appease the prompt. After 3 tries it'll stop trying and just put you on an "Authorization Failed" screen (not the sharepoint "You don't have permissions, sign in as a different user" screen though).

 I am not sure why this happens. The timing doesn't seem to have any pattern nor does what you are currently doing. I've had it happen to me in my MySite, Edit Mode on a page, just cruising around lists and the like.

 This may have also caused some problems in Outlook with synced task lists prompting for a username and password.

A bit of an update: It appears that it happens after some amount of time passes and one browser has stayed open. I just tried to open my sharepoint site on a new tab from an IE window I've had opened for some time and I couldn't even get to the front site without the prompt (and never accepting). It is quite confusing.

I know this thread is way stale, but by posting my experience here I hope to bring it back current and add my call for help. 

I have been having the *exact* same problem since setting up my MOSS farm in early April. I've been running a WSS 3.0 single-server setup for right at a year now and have never had an issue like this, but then it doesn't use (or need) Kerberos. It has been my observation as well that the underlying reason might be a timeout issue. Just as nash says, once it occurs you can close the browser and immediately reopen it and everything is fine. I've had the problem correct itself before, though, just by leaving the browser alone then trying again later.

Interestingly, this problem also occurs with frustrating regularity when using SharePoint Designer 2007, and the fix is the same - close and reopen the application. SPD's error is "You do not have permission to do this operation", which apparently is the same message thrown by the Frontpage server extensions, because googling that message got a lot of results, none of which obviously were helpful. Once when I tried to just close and reopen the site without closing SPD, I got a slew of permission errors (with logon prompts) that I just ESCaped through, and the site opened in folder view where I could browse around and look into the subfolders, lists and libraries. I was still denied making any changes, though.

I normally use Firefox for all my browsing, and would like to report I haven't seen the issue in that browser, but MOSS doesn't render well outside of IE (tends to leave out all XmlHTTPRequest/AJAXy stuff) so I can't really use it for the day to day work I need to do. Also, I've tried sniffing the HTTP conversation with Fiddler but this breaks the communication completely (due to the proxy?) and connections always fail due to permissions. I use Vista and wanted to blame the problem on that, but I've seen it occur on XPSP2 so no luck there either.

It doesn't seem the problem is with MOSS per se, but with IIS and/or Kerboros and/or the browser. MOSS exposes a lot through web services, is there something hiding there to cause these errors? This is a maddening problem on so many levels, but primarily for me is because I feel the answer is just *right* there if someone with more experience in IIS permission intricacies would just heed the call and help out we poor souls.  

I've actually gotten a solution to all the login issues we were having. First we stopped using the Kerobros authentication because we really didn't need it.  Then there are a couple settings in IE we have to set for each user (they also fix outlook auth prompts that kept happening).

 First in Internet Options under security highlight local intranet and click "Sites". Then click advanced and add your main sharepoint portal to that list (uncheck the https checkbox if its checked).  After that with local intranet still highlighted go to the Custom Level button and scroll all the way down to the bottom for Logon options. Make sure that "Automatic logon with current user name and password" is selected.

That solves 90% of the issues users have with frequent log-in prompts.  We recently switched from a test to a retail server and there was some other issues with outlook prompts and hangs related to the MySite settings. If you've had a previous install of sharepoint on a different server make sure users who had MySites there set the new server's MySites to their default. You can find a link to do this on their MySite page near the upper right when they first log in (Set as Default MySite or something).

 I hope some of this helps!

Thanks for your quick reply. My hope sunk a bit when I read that you had stopped using Kerberos as I believe(d) it to be the most likely culprit, and we really must use it for communications with the shared services, specifically the BDC.

As well, I thought I had already done the two IE setting changes you suggested. Just to be thorough though, I checked and found that my portal was in the Trusted Sites and not the Intranet Zone (may make a difference, maybe not, but still better practice to have it there), so I moved it. I had already set the "Automatic logon with username and password" as I thought, but it was set in the Trusted Sites zone so I set it as well in Intranet.

I'll be plowing ahead after making these suggested changes, hoping they are the magic fix, and will post back when I have something definitive.

Thanks, again, nash.
 

I have MOSS 2007. Frequently sharepoint will ask for login credentials when
going to the site, opening a document, etc even though it should be (and is)
getting the credentials from Windows. Usually I can just hit Cancel to the
login prompt and I can get in/open the document or do whatever I was doing.
This does not always happen, however. Sometimes it doesn't prompt me and
lets me through as it should using Windows Authentication.
Any ideas?

The only other thing I can think to try based off of our experiences is entering the fully qualified domain name for your sharepoint server. So if you go to http://mysharepoint/ to open your main portal and your company's domain is mydomain try adding http://sharepoint.mydomain.net or http://sharepoint.mydomain.com .

You might also want to try to add the sites to your Trusted Sites in Internet Explorer.