Re: Windows 2003/IIS 6.0 + IE 6.0 - random authentication dialog

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 08/20/03 

Date: Tue, 19 Aug 2003 21:17:36 -0700

We'll need a NetMon (network trace) of the failing transaction along with
configuration of the vdir containing resources requested (auth-types that
are enabled, etc). NetMon can be found in Add/Remove Programs under Network
Tools.

Proper Integrated Authentication functionality requires strict adherence to
connection open/closure, which is something NetMon will definitively capture
while everything else is indirect inference (i.e. not good enough for
diagnosis).

I suspect some connection keep-alive semantic within your ISAPI (intentional
or not) is at play, where your ISAPI is asking for connection keep-alive
when it actually needs connection closed. 

-- 
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"AIDS" <aids@programmer.net> wrote in message
news:8accbd2e.0308190952.638a2625@posting.google.com...
Hi All!
I've got a problem with our application -> there is a problem with
authentication.
Our application has a Web UI and also for dynamic content an ISAPI
extension DLL is used.
The application's web-site is configured to use integrated Windows
authentication and runnning under Windows 2003 Server Standard
Edition/IIS 6.0
(stand-alone server, not a member of domain). As a client Internet
Explorer 6.0 is used. I run it on the same computer as a server under
Administrator account.
Occasionally IE displays authentication dialog asking user to input
user name & password. Even if I type correct user name/password the
dialog appears again and again.
I checked NTFS permissions on every file on the web-server -> for all
of them Administrator has Full Access rights.
It happens (not every time) when the UI requests dynamic content from
the server using our ISAPI DLL. I have checked server variables from
inside the DLL and found that AUTH_USER and LOGON_USER are always set
to correct username (Administrator in my case). So I assume that the
DLL is called using right user credentials.
Then I looked at the way we request dynamic content.
We use a special frame (it's a hidden frame) and Javascript function
which builds a URL with parameters, passes it to hidden frame and then
parses results.
What I found that sometimes IE failes to authenticate against IIS
using
integrated Windows security.
Application was working OK under Windows 2000/IIS 5.0.
At the moment I am completely out of any ideas what causes that
behavior.

Relevant Pages

  • Re: Problem - moving to IIS 6.0
    ... server supports/requires authentication, so it always sends a request using ... client to figure out how to optimize the requests to not trigger unnecessary ... server can always be mis-configured to foil any optimization strategy of the ... I've got an ASP.NET app that I've designed and tested on ...
    (microsoft.public.inetserver.iis.security)
  • Re: URLSCAN makes pages with integrated authentication very slow
    ... Because since I have done this with the server header remove, ... >> Authentication typically involves at least one 401.x response prior to ... Performance of authenticated requests is the ... >> and without URLScan from your machine. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Pin generation algorithm question
    ... even if it is a database of tokens in issue. ... All the authentication server does is accept a request, ... The average rate is about 2 authentication requests ...
    (sci.crypt)
  • Re: Problem joining domain
    ... DNS-type requests, like ping, work OK but you can not browse. ... >> At the moment I have one server that I have joined to the domain. ... >> The Security System detected an authentication error for the server ... >> are currently no logon servers available to service the logon request. ...
    (microsoft.public.win2000.active_directory)
  • Re: Kerberos machine authentication - apparent authentication fail
    ... > until logon), the wireless connection can kick off when it is ready. ... > was confirmed in the server event logs with IAS (i set that up as the radius ... > as an ordinary user kicks in and takes over from the machine authentication. ... > while the network sorts itself out and a double click on a network link of ...
    (microsoft.public.windows.server.security)
Loading