Authentication with AD, NT4.0 and IIS

I'm having a problem.

I have a web app on a windows 2003 server (sp1) that is part of an AD domain.

I have users in a NT 4.0 domain that are trying to access the website via Windows Authentication.

Windows Auth works fine for AD users. Not so much for the 4.0 users.

LMHost files on 4.0 PDC point at the PDC emulator of the AD domain.
LMHost on the IIS server has an entry for the 4.0 PDC and the #DOM tag.

I can map a network drive to the NT 4.0 domain server (IPC) from the web server using the net use command and specifying the 4.0 domain user account.

Now, when i try to browse the web app from a 4.0 user's machine, i get:

"No authority could be contacted for authentication "

Any ideas?

I also wanted to add, this is happening with both DNS names and IP addresses.

 

I think you will need to set up a trust relationship between the NT4 domain and the AD. The trust need only be one way (AD trusts NT4 users). You may also have to set up permissions on the application folders for an NT4 user group.

 

Sorry, i should have added that.

We have a two way trust going between the two.

 

I can't find any specific note on NT4 permissions in 2003 IIS documentation in my "library ".

From what I have found it should be NTFS permissions controlling access in your set up (rather than using web permissions). Therefore, I'd look at your file access rights on the files being published by the IIS service. You will need an explicit rule that allows access to a group containing the NT4 users.

I'm not sure what you mean by this, but it might be worth pointing out that authentication for NT4 was a NetBIOS process and therefore worked with Microsoft Domains. These are different to DNS domains. I think using a DNS domain name as part of an NT4 log on may be taking you up a blind alley.

Have you tried using the domain specific login. That is rather than entering:

• username

Try using

• domainname\username

By the way, I can never remember the direction of the slash for this. It may be domainname/username