Authentication troubles

From: Jerry (jerry.giacinto_at_ketteng.com.nospam.com)
Date: 03/23/04 

Date: Mon, 22 Mar 2004 16:57:37 -0700

  I have a web folder setup on IIS 5 on Win 2K server. The authentication
level is set to Integrated Windows Authentication, and I do not allow
anonymous access. It wouldn't matter if I did, because the folder and it's
contents have specific NTFS permissions. This has been working well for all
clients accessing it until now.

  One client is running Win 98 se with IE 5.5 SP2 - current on all patches.
When the user tries to connect from that machine using IE, he gets prompted
three times for a username and password, then it gives the "You are not
authorized to view this page" message in IE. When he tries to add the web
folder in Windows Explorer, he gets prompted three times, then gets the
message, "You do not have permission to access this web folder location."
All I get in the IIS log is a 401 entry, but no error messages or indication
of what is happening.

  When I switch the authentication to Basic, he is able to logon just fine.
It appears that the username is not being received correctly by IIS because
he is not able to lock out the account after enough tries with an
intentionally wrong password (but it can be done by a client that is able to
logon normally).

  He is running Roadrunner-provided hi-speed internet with Norton Personal
Firewall. He has tried with the firewall software disabled, but that did
not work. I have verified that the server will accept LM, NTLM, and NTLM
v.2 requests. I have verified his IE Security and Advanced settings with a
similar client that is able to logon correctly. I am running out of ideas.
The only thing I can figure is that Roadrunner may have something in their
setup that is not allowing this to function - but that seems like a
longshot.

  Although I have found several posts dealing with Integrated Windows
Authentication and logon failures, I have not found any that solve or
explain my circumstance. Any help would be greatly appreciated.

  One side note about the IIS logs - when it logs his attempt to connect,
his client information is listed as
(compatible;+MSIE+5.5;+Windows+98;+T312461). I looked up the T312461
because it doesn't show up on any other clients that I've seen, even if they
are current on MS patches. It does not appear to be part of the
authentication problem, but I'm including it just in case it sticks out to
someone.

Thanks for your help,
  Jerry

Relevant Pages

  • Re: HELP PLEASE The request failed with HTTP status 401: Access Denied.
    ... Web Security: Part 2: Introducing the Web Application Manager, Client ... Authentication Options, and Process Isolation ... It introduces the Web Application Manager in IIS that ... logon session, which is dangerous. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Authentication troubles
    ... I have a web folder setup on IIS 5 on Win 2K server. ... level is set to Integrated Windows Authentication, ... similar client that is able to logon correctly. ...
    (microsoft.public.inetserver.iis)
  • Re: HTTPWebRequest.request.GetResponse fails: remote server returned error: (401) unauthorized.
    ... "IIS appears to prevent access" because even if IIS prevents access, ... Do you want authenticated user credentials from the client ASP.Net ... authentication protocols as they should be. ... Impersonation is achieved in the Client applications by using the ...
    (microsoft.public.inetserver.iis.security)
  • Re: WebDAV and DFS
    ... IIS6.0 inherits whole WebDAV functonality from IIS5.0. ... Actually IIS also supports pass-through authentication feature: ... use IE's 'Open as Web Folder' function ...
    (microsoft.public.inetserver.iis)
  • Re: How does IIS handle user impersonation token?
    ... I am trying to understand how IIS handles authentication on subsequent> round ... >: trips to the server. ... how does IIS handle the user>: ... > For HTTP based authentication mechanisms,> the client sends the credentials to IIS using the Authorization: header as> part of each request to the server. ...
    (microsoft.public.inetserver.iis.security)