Enabling NTLM Authentication in Firefox and Internet Explorer

This tip is useful for organizations who are standardized on Microsoft technologies (Active Directory, IIS, and ASP.NET) and need to provide minimal-intrusion authentication for their internal web applications. I was stumped for a long time on this one. Here’s the scenario:

All of my ASP.NET applications – at this point – are internal to the organization that I work for. We are a strictly Microsoft shop, and, because of this, I always leverage Active Directory in everyway possible. Well, this is great from my (a developer’s) perspective, as it means that I don’t have to build and maintain a login system. However, I recently started getting feedback from users across the country saying that they were being challenged with a login screen when they accessed the applications. This was okay, as they could still get in using their Active Directory accounts, but sometimes they had to append the domain to the beginning of their name, and it all became kind of a pain.

We are a diverse organization, in that we have many different network configurations. Some of our users are on high-quality T1 connections, while others are still on intermittent – at best – connections. Because of this disparity, I initially blamed the login problem on different network configurations (firewalls, distance to domain controller, etc.), but after doing a bit more research I found that the problem was actually browser related.

By the way, the Internet Explorer setting can also be implemented via group policy (thanks to Chris, James, and Marilyn for helping me figure this one out). Look in the registry at:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

So, here are the steps you need to take to enable NTLM pass-through authentication in Internet Explorer (6 & 7) and Firefox (2):

Internet Explorer

Note: These instructions apply to both IE 6 and IE 7, although there may be slight differences in the screenshots below.

Note2: For some reason, some of the entries that are added to the Local intranet zone seem to be persistent. You’ll delete them in the interface, close all the windows out, come back and they’ll reappear. The only way I found to permanently get rid of them was to manually delete the registry entry located at the location cited just above this section.

1. In Internet Explorer, click on Tools and select Internet Options (see screenshot below)…

2. Next, click on the Security tab at the top of the Internet Options window (see screenshot below)…

3. Once the contents of the Security tab are displayed, highlight Local intranet and click on the Sites button (see screenshot below)…

4. In the Local intranet dialog that pops up, make sure that the last three boxes are checked and click on the Advanced button (see screenshot below)…

5. In the next dialog, type the following into the Add this website to the zone: textbox: http://www.yourdomain.org and click on the Add button (see screenshot below)…

Note: If you’d like to enable Active Directory pass-through authentication for all the sites on a domain, type the following into the Add this website to the zone: textbox: http://*.yourdomain.org.

Mozilla Firefox

Note: These instructions have been tested on Firefox 2.0.0.1.

Note2: Information first encountered here: http://ackbarr.xoops.org.

1. In the address bar of your Firefox browser window, type the following: about:config and press Enter (see screenshot below)…

2. In the configuration page that displays, scroll down to the following entry: network.automatic-ntlm-auth.trusted-uris and double-click on it (see screenshot below)…

3. In the Enter string value that pops up, type http://www.yourdomain.org into the textbox and click OK (see screenshot below)…

Note: If you’d like to enable Active Directory pass-through
authentication for all of the sites on a domain, type the following
into the textbox: .yourdomain.org.