Windows integrated (NTLM) authentication vs Windows integrated (Kerberos)

c# asp.net iis-6 kerberos ntlm
Nitin S picture Nitin S · Jul 19, 2011 · Viewed 24k times · Source

What is the difference between Windows integrated (NTLM) authentication and Windows integrated (Kerberos)?

How to implement these in IIS6

w.r.t. MSDN

Answer

Anders Abel picture Anders Abel · Jul 19, 2011

Kerberos and NTLM are different algorithms for validating a user's password, without reveiling the password to the server. More info about NTLM and Kerberos at Wikipedia.

If you enable Windows authentication, Kerberos will normally be preferred and if that is not available it will fall back to NTLM.

  • NTLM only requires the client to communicate with the web server in order to authenticate. The web server handles the communication with the domain controller. This is an advantage with publically available sites where a DC cannot be reached from the Internet. Unfortunately the cryptography used by NTLM is outdated and can no longer be considered secure. NTLM should only be used over https.
  • Kerberos requires the client to get a ticket from the domain controller, which makes it more suitable for Intranet scenarios. Kerberos is however more secure and can handle delegation, where the web server can access other resources (e.g.) a file server, using the client's identity.

Related questions

Display custom error page when file upload exceeds allowed size in ASP.NET MVC

My main issue is that I want to display an custom error page when an uploaded file exceeds allowed size (maxRequestLength in web.config). When the big file is uploaded an HttpException is thrown before my upload action method in …

Read More
How to get the URL of the current page in C#

Can anyone help out me in getting the URL of the current working page of ASP.NET in C#?

Read More
How do you set the Content-Type header for an HttpClient request?

I'm trying to set the Content-Type header of an HttpClient object as required by an API I am calling. I tried setting the Content-Type like below: using (var httpClient = new HttpClient()) { httpClient.BaseAddress = new Uri("http://example.com/"); httpClient.DefaultRequestHeaders.…

Read More