Re: IIS 6.0 NT Authorization problem, slow response

From: David Wang [Msft] (someone_at_online.microsoft.com)
Date: 11/06/04


Date: Fri, 5 Nov 2004 23:00:52 -0800

The reason those 401 errors show up in the log file but not IE is because
they are part of an expected authentication handshake. Modern browsers do a
LOT of such type of processing on your behalf such that multiple
request/response of various status code could be automatically negotiated
even if all YOU saw was clicking on a single hyperlink.

The sequence of 401.2 -> 401.1 -> 200 is expected when the browser
negotiates the 3-way handshake with the server for Integrated
Authentication. However, it's not supposed to happen on every single
request -- if that happens, it suggests that *something* is closing the
connection aggressively. Some possibilities include the web application is
coded that way, maybe you have KeepAlives disabled on IIS, or maybe the
client is intentionally re-negotiating.

If you also saw the problem on IIS5 prior to IIS6, it is almost certainly
not a problem with IIS but rather with something you did.

832911 has nothing to do with your situation.
297210 mentions the behavior is by design for security reasons (opening a
cross-frame must re-authenticate), so you have no choice if you use IFrames
and Integrated Authentication.

So far, everything you have said is "by-design".

What do you mean by "every 1-5 seconds I receive in IIS 6.0 log 401
errors..." -- is the browser making any requests? Are you sure those 401
errors are caused by your browser and not someone else? Can you give more
context, such as a network trace, of your claimed slow response?

-- 
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Janis Buks" <Janis Buks@discussions.microsoft.com> wrote in message
news:1562A277-3C5E-4A54-B2ED-514A2F2ED972@microsoft.com...
Every 1-5 seconds I receive in IIS 6.0 log 401 errors but none of them
appeares in client browsers. IE processes pages normally without errors, but
with delays(sometimes long delays).
We have 2003 server system with MSSQL2k on it and asp/asp.net applications
running. Previously we had win2k and iis 5.0 and same trouble. IIS uses only
NT4 file security when client requests file.
My log looks like this(below is only one! real life page request e.g. click
on link and result in browser without errors), somehow ie requests 3 times
one file but client doesn't even imagine this.
username          LogTime              processingtime
TMS\Edvard        2004.11.04 13:58      265
-                 2004.11.04 13:58      0
-                 2004.11.04 13:58      0
servicestatus win32status             target
200               0                    /abons/seek.asp
401               0                    /abons/seek.asp
401              -2146893042          /abons/seek.asp
Searched all net, no answer..only releated symptoms found on
support.microsoft therefore please help me to find answer to questions
below:
Any one knows hot to receive in 832911 article listed trouble hotfix?
And how to solve article 297210 if i have iframes in pages, but no chance to
rewrite code without iframes or no chance to use other than NT
authorization?


Relevant Pages

  • Re: Cant make a domain user the "anonymous access" user
    ... When dealing with authentication issues it is VERY important to ... Some of the things you claim is not consistent with a default IIS ... If you use a browser that cannot do NTLM, by definition, a 401.2 error is ... user account that works and your domain account that does not. ...
    (microsoft.public.inetserver.iis.security)
  • Re: client gets always every first time for every page a 401
    ... cause the browse will always try anonymous access first. ... How IIS Authenticates Browser Clients ... > I have an issue with the basic authentication from IIS. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Authentication Problem - Help
    ... implies impersonate the LOGON user specified by IIS ... expired process is shutdown and a new process is ... requests allowed before process is shutdown ... cy]" - Level of authentication for DCOM ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: logout a browser under integrated security
    ... due to the browser. ... but not server ... >server by using Basic or NTLM authentication, ... >IIS Authenticates Browser Clients" ...
    (microsoft.public.inetserver.iis.security)
  • Re: NT Authentication with ASP
    ... Without credentials, IIS will assume anonymous access. ... If Anonymous authentication is enabled, ... unless the browser has already authenticated. ...
    (microsoft.public.inetserver.asp.general)