Double Web Authentication with Office 2003 attachments

I have seen this posted, but haven’t seen an answer to this specific issue:

We are running 6.5.4 server. Our clients use IE 6.0.29. We have Office 2003 installed.

When a user tries to open an Office attachment (Word, Excel), they are forced to re-authenticate even if they are logged into the site. For instance:

User logs in with Manager access to http://servername/folder/app.nsf/

User clicks on attachment icon (attachment in Rich Text field) with the following URL:

http://servername/folder/app.nsf/dc7e3010be7b2e4285257027006d0cbd/972ec845e3d75e32852570960052e69f/$FILE/190Review.doc

Word is triggered to open, but the document is not displayed, the custome login screen from our domcfg is opened in word. (without custom login screen, a dialog opens for username and password).

This has only occured after Office 2003 was installed. This does not occur for attachments other than Office(pdf’s, graphic files, etc.).

Any ideas?

Subject: Double Web Authentication with Office 2003 attachments

This is a known drawback with new security checks in Internet Explorer and Office 2003. See the Microsoft Knowledge Base article:

Guess what… Firefox (and I assume other browsers too) don’t have this problem.

Hope that helps!

John

Subject: Double Web Authentication with Office 2003 attachments

I’ve seen this before. Office apps include an embedded IE control, which Micro$oft considers a feature. The problem seems to be that the instance of IE that is used by Office is not the same as the instance that is already running, so the existing authentication credentials don’t apply.

The only two workarounds I can think of are: configure IE to load the Office apps inside the browser window (I’m not positive this works, but I seem to remember that it does - it confuses the users, though); or pass the (or some - you can use a fake user here) user credentials explicitly on the link. The second is universally known to be a Really Bad Idea, and it is barely even worth talking about. The only reason to consider it would be if this is a closed system, intranet only, not an industry or company that gets audited, and these documents are not sensitive in any way.

Oh, one other possibility - force IE to save, not open, Office attachments - then the users have to know how to find them, and there are multiple steps involved - but it does work.

Subject: RE: Double Web Authentication with Office 2003 attachments

Thanks for the response. I spoke with someone at another company not having the issue, so we are going through our install policies to see where they differ. You suggestion will hopefully narrow the search. I will post the specific issue when i find it.