#113529 - 2004-02-07 12:24 AM
Preconfigure IE 6 with username/password
|
bUZZeR
Fresh Scripter
Registered: 1999-12-09
Posts: 19
Loc: N-Hamar, Norway
|
Hi all!
I have a question for you, we have a customer running some terminalservers used for browsing. The clients use IE6.
There is a Linux firewall with LDAP connection used for user authentication. The user gets a prompt for username/password in IE, is there any way for us to preconfigure IE's Auto Complete with a username/passord ?
|
|
Top
|
|
|
|
#113533 - 2004-02-11 08:15 AM
Re: Preconfigure IE 6 with username/password
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
|
For now, until you run the new MS Security patch which will disable this unless you modify the Registry to prevent it.
You should be able to do something like this.
Code:
$Desktop=ReadValue('HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders','Desktop')
WebLnk($Desktop+'\Microsoft.url','http://johndoe:secret@@www.microsoft.com')
Function WebLnk($url,$site)
Dim $RC
If 0=Exist($url)
$RC=WriteProfileString($url,'DEFAULT','BASEURL',$site)
$RC=WriteProfileString($url,'InternetShortcut','URL',$site)
EndIf
EndFunction
|
|
Top
|
|
|
|
|
#113534 - 2004-02-11 08:21 AM
Re: Preconfigure IE 6 with username/password
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
|
The fix to the fix to revert back is supposed to be
Code:
$EnablePass=WriteValue('HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE','iexplore.exe', 0, 'REG_DWORD')
$EnablePass=WriteValue('HKLM\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE','explorer.exe', 0, 'REG_DWORD')
|
|
Top
|
|
|
|
|
#113535 - 2004-02-11 09:42 AM
Re: Preconfigure IE 6 with username/password
|
jpeachman
Fresh Scripter
Registered: 2002-11-18
Posts: 39
|
Has anybody heard whether this "fix" undoes any security-related functionality that was added with the latest IE security patch? I keep seeing those registry changes floating around with no discussion as to whether there might be any other impact.
Joe
|
|
Top
|
|
|
|
|
#113536 - 2004-02-11 10:10 AM
Re: Preconfigure IE 6 with username/password
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
|
Well I wouldn't say it undoes all of it, but it does circumvent the USERNAME:PASSWORD issue.
Basically this is being done to curtail spoofing of website addresses. In older versions of IE you would see the ENTIRE URL address but in newer version of IE you don't.
Example:
Old Browser:
http://www.wingtiptoys.com@example.com
IE6 SP1 and Server 2003 only show
http://example.com
You can read more about it here
http://support.microsoft.com/default.aspx?scid=kb;en-us;834489
|
|
Top
|
|
|
|
#113537 - 2004-02-11 08:19 PM
Re: Preconfigure IE 6 with username/password
|
jpeachman
Fresh Scripter
Registered: 2002-11-18
Posts: 39
|
I guess that's what I'm asking. If you apply this fix, are you now vulnerable to address spoofing again? I manage two different networks (a school and a nonprofit organization), with some pretty unsophisticated users at each. In both my cases, there's probably no need to do this at all, but I'd hate to see people applying this fix and then have naive users exposed to the sort of scams that might try to take advantage of spoofed addresses again. Might not be a problem where users are more savvy to begin with; that's just not the environment I'm familiar with! 
Joe
|
|
Top
|
|
|
|
|
#113538 - 2004-02-11 09:04 PM
Re: Preconfigure IE 6 with username/password
|
jpeachman
Fresh Scripter
Registered: 2002-11-18
Posts: 39
|
OK, Microsoft apparently now has an official patch to restore this: XMLHTTP call fails for URLs with embedded user credentials
Hmmm...except "This fix will only enable the scenario where user credentials are passed as parameters in the Open() method call. It will not enable scenarios where the user credentials are embedded in the URL."
Joe
Edited by jpeachman (2004-02-11 09:49 PM)
|
|
Top
|
|
|
|
Moderator: Arend_, Allen, Jochen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 1046 anonymous users online.
|
|
|
