digest authentication on virtual (networked) directories

I'm using digest authentication for access to our intranet and it's
working perfectly when the directories are local to the webserver.

If I add a virtual directory that points to a directory on another
machine (\\server\share\directory etc.), digest authentication no
longer works...

....unless I add NETWORK to the directory's ACL list... but when I do
that any user with a valid AD account can log on to the directory and
the share level ACLs no longer have any effect...

If I don't have NETWORK in the ACL list, I get a prompt for
authentication 3 times, then a "you are not authorized... etc." error
message.

Looking through the Security Event log on the web server give me three
entries saying the my logon request was successfull, but it seems to
be falling over between webserver and network share.

Anyone have any ideas???

Many thanks in advance,

cw

On 4 Jun, 16:49, cw1972 wrote:
> I'm using digest authentication for access to our intranet and it's
> working perfectly when the directories are local to the webserver.
>
> If I add a virtual directory that points to a directory on another
> machine (\\server\share\directory etc.), digest authentication no
> longer works...
>
> ...unless I add NETWORK to the directory's ACL list... but when I do
> that any user with a valid AD account can log on to the directory and
> the share level ACLs no longer have any effect...
>
> If I don't have NETWORK in the ACL list, I get a prompt for
> authentication 3 times, then a "you are not authorized... etc." error
> message.
>
> Looking through the Security Event log on the web server give me three
> entries saying the my logon request was successfull, but it seems to
> be falling over between webserver and network share.
>
> Anyone have any ideas???
>
> Many thanks in advance,
>
> cw

more info from the webservers Security Event Log - this is what is
logged after 3 logon attempts - all are reported as successfull logons
but I never get access to the virtual directory:

Logon attempt by: WDigest
Logon account: username
Source Workstation: SERVER
Error Code: 0x0

Special privileges assigned to new logon:
User Name: username
Domain: DOMAIN
Logon ID: (0x0,0x27DBD9E)
Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
SeEnableDelegationPrivilege


uccessful Network Logon:
User Name: username
Domain: DOMAIN
Logon ID: (0x0,0x27DBD9E)
Logon Type: 3
Logon Process: WDIGEST
Authentication Package: WDigest
Workstation Name: -
Logon GUID: -
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.x.x
Source Port: 4463


Logon attempt by: WDigest
Logon account: username
Source Workstation: SERVER
Error Code: 0x0


Special privileges assigned to new logon:
User Name: username
Domain: DOMAIN
Logon ID: (0x0,0x27DC464)
Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
SeEnableDelegationPrivilege

Successful Network Logon:
User Name: username
Domain: DOMAIN
Logon ID: (0x0,0x27DC464)
Logon Type: 3
Logon Process: WDIGEST
Authentication Package: WDigest
Workstation Name: -
Logon GUID: -
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.x.x
Source Port: 4463


So it looks to me that webserver is authenticating me fine, just never
passing on my credentials to the network resource on the virtual
directory.