Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. Unexpected authentication prompts while you use an OWA website that is published by using ISA Server 2006 SP1 if RSA authentication and FBA are used

Unexpected authentication prompts while you use an OWA website that is published by using ISA Server 2006 SP1 if RSA authentication and FBA are used

Symptoms

Consider the following scenario:
  • You publish an Outlook Web Access (OWA) website by using Microsoft Internet Security and Acceleration (ISA) Server 2006 Service Pack 1 (SP1) that uses RSA authentication.
  • You authenticate client connections by using OWA Forms Based Authentication (FBA).
  • You enable an idle time-out setting for Public Computers and set a specific time. 
  • You enable the No delegation, and client cannot authenticate directly or No delegation, but client may authenticate directly delegation setting.
  • You connect to the OWA website from a public computer.
In this scenario, you may be prompted for your credentials unexpectedly while you use the OWA website. This reauthentication occurs periodically.

Note The correct behavior is to receive the reauthentication prompt when you resume to use OWA after you remained idle for the specified time. 

↑ Back to the top

Cause

This issue occurs because the idle time-out setting for public computers is handled as a session time-out.

When a public computer connects to the OWA website, they are prompted for credentials. However, the session times out after the time that is specified in the idle time-out configuration. Therefore, a new authentication is required while the connection remains active.

↑ Back to the top

Resolution

To resolve this issue, install the hotfix rollup package that is described in the following Microsoft Knowledge Base (KB) article:
2475184 Description of the ISA Server 2006 hotfix package: December 2010

↑ Back to the top

More Information

If a Private Computers idle time-out is needed, see hotfix 941162. The Collect additional delegation credentials in the form option must also be selected in order to enforce the Private Computers time-out. This is by design.

The script in hotfix 941162 reverses the behavior of ISA to be the same as before the hotfix and to have some UI exceptions. Additionally, you can specify a time-out for Private Computers by using the ISA Server Management console. You can still specify whether the client computer is a public computer or a private computer by using the options on the RSA SecurID form. However, these settings have no effect for Private Computers. If you reverse the effects of the script, and if you select the option that collects additional credentials, ISA uses the Private Computers time-out.

↑ Back to the top

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

↑ Back to the top

References

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
941162 In ISA Server 2006, you cannot set a session time-out for private computers in a Web listener that has the RSA SecurID authentication method configured
For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates

↑ Back to the top

Keywords: kbsurveynew, kbexpertiseinter, kbqfe, kbfix, kb

↑ Back to the top

Article Info
Article ID : 2481980
Revision : 1
Created on : 1/7/2017
Published on : 12/24/2010
Exists online : False
Views : 70