Browser pipelining

Question

Hi Crew,
Has anyone had any experience or learings about browser pipelining.
It appears that the J2EE Engine supports pipeling but IE does not.
We have a situation where because the TCP connection is closed several times during a page load, the NTLM authentication is executed multiple times during the rendering of the page.
This has a significant impact on performance due to latency.
Look forward to hearing your thoughts.
Paul

Answer 1

Ok, it seems you have to do the following :
1. (if the dns name of the portal is not the same as the computer name (netbios))
setspn -A HTTP / <portal_host_name> <netbios_name>
(reference http://support.microsoft.com/default.aspx?scid=kb;en-us;326985 and http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/setspn-o.asp)
If this is not done, you will only get a ticket if you add the name of the server as a DNS entry in the host file(C:\WINNT\system32\drivers\etc\host) of the client computer.
If you install kerbtray from http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/kerbtray-o.asp
you can see which kerberos ticket you have. You should have one for HTTP/<portal_host_name>
Another way to check this is to view the event log on the server on the security tab. For each logon/logoff event the method is displayed. This should be kerberos, not ntlmssp.
2. The computer must be trusted for delegation of tickets . a.     On the domain controller, click Start, point to Settings, and then click Control Panel.
b.     Double-click the Administrative Tools folder, and then double-click Active Directory Users and Computers.
c.     Under your domain, click the Computers folder.
d.     In the list, locate the IIS server. Right-click the server name, and then click Properties.
e.     Click the General tab, click to select the Trusted for delegation check box, and then click OK.
But even after having done this changes it seems like there are quite a few reauthentications, although alot fewer than before (and they use less http packages). Perhaps this is the way it works ?
(ps a very good walkthrough of IIS authentication is available at http://support.microsoft.com/?scid=http://support.microsoft.com%2Fservicedesks%2Fwebcasts%2Fen%2Ftranscripts%2Fwctd060904.asp , but it doesn't say what happens for subsequent kerberos request to IIS).