Windows Integrated authentication over SSL 

Vadim @StresStimulus

Administrator

Posts: 583

To configure Fiddler to authenticate on your behalf, click Rules > Customize Rules. Scroll to the OnPeekAtResponseHeadersfunction and add the following code:
static function OnPeekAtResponseHeaders(oSession: Session)
{
// To avoid problems with Channel-Binding-Tokens, this block allows Fiddler
// itself to respond to Authentication challenges from HTTPS Intranet sites.
if (oSession.isHTTPS &&
(oSession.responseCode == 401) &&
// Only permit auto-auth for local apps (e.g. not devices or remote PCs)
(oSession.LocalProcessID > 0) &&
// Only permit auth to sites we trust
(Utilities.isPlainHostName(oSession.hostname)
|| oSession.host.EndsWith("microsoft.com"))
)
{
// To use creds other than your Windows login credentials,
// set X-AutoAuth to "domain\\username:password"
oSession["X-AutoAuth"] = "(default)";
oSession["ui-backcolor"] = "pink";
}

//... function continues
You will probably want to adjust the two values marked in green. The first controls what servers Fiddler is willing to release credentials to—by default, I allow Fiddler to send credentials to any “plain” hostname that does not contain a dot (Intranet sites) and I also allow any site ending in Microsoft.com, because some of our CBT-protected servers have hostnames that contain dots. The second value controls what credentials Fiddler will attempt to use. If you specify explicit credentials in domain\\username:password format (note the double-backslash required by JavaScript), Fiddler will attempt to use those credentials. If you instead specify (default), Fiddler will attempt to use the login credentials of whatever user-account that it is running under. Since I run Fiddler in my own account, I use “(default)”.

After you make these changes and save the file, Fiddler will begin to authenticate on your behalf to the servers' you’ve selected. The final line in the script sets the background color of automatically authenticated responses to pink so that they’re easily visible in your session list.