Flicks FAQ: Reprompt For User Password

Q. I get into the the protected area, but it keeps re-prompting me with multiple prompts for a username and password.

A. Always make sure that Basic Authentication in IIS/MMC is turned off.

If you are including images, make sure the images are in a sub-directory of the protected area.

If you are using frames, make sure that all the frame components are in the same directory, and that it is the same protected directory.

When you are prompted the second and third time, what is the realm indicated in the prompt dialog? If it is not the same as the one set by AuthentiX, there is a file being protected by IIS/NTFS. When you escape out of the prompt, you should see an Access Denied message. If this is not the one you set with AuthentiX, there is a file being protected by IIS/NTFS.

If you are using ODBC to validate users, and you are getting reprompts that cannot otherwise be explained, try setting the "Impersonate NT User" in the ODBC settings for that directory's protection, to an NT account that has valid access to the database.

Windows2000
With Windows 2000, Everyone has only list permissions within the inetpub directory by default, even though the advanced properties say they have read and execute, they are not inherited by default like in IIS4/5.

AuthentiXISP / WebQuotaISP

If you are protecting content on several drives using Basic Authentication, make sure that the realm is the same for each.

HTTP Keep-Alives
Try turning off HTTP Keep-Alives, some filetypes (eg pdf files) will multiple prompt, because the browser asks for information in 1mb chunks (or thereabouts), but only supplies the username and password for the 1st chunk, which will cause multiple prompting. Sometimes quitting out of the 2nd and subsequent prompts, allows you to see the file anyway, which is what you want, but is somewhat disconcerting.
You turn off HTTP Keep-alives by going to the master properties for the website (In IIS/MMC) and turning off the corresponding checkbox.

Also see here