Re: Stumped by Authentication Problem


"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message news:uVTVd2JOIHA.4136@xxxxxxxxxxxxxxxxxxxxxxx
"Ken Schaefer" <kenREMOVE@xxxxxxxxxxxxxxxxxxxx> wrote in message news:OHKs%23YyNIHA.5980@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

This isn't an IIS issue - something is happening lower down in the stack (e.g. inside LSASS or similar).

The initial request is denied with an Unauthorized (401) HTTP status. The client then appears to be sending credentials, and the server is returning 500. The Win32 status indicates an internal security error occurred.

I would start by looking in the Windows Event Logs to see if any errors are being logged there.


Indeed Ken, and might not the app trace be useful too, as it seems
by 500 that it is not handling the (unanticipated?) access denial.

It could be, but Win32 error 2148074244 is SEC_E_INTERNAL_ERROR, which indicates to me tha there is an error below IIS. IIS is then seeing this not as an access denied, but some other error it is not equiped to handle, and so IIS generates the 500 Internal Server Error, not the application. The application probably isn't seeing the request at all

Cheers
Ken


Roger

"SirCodesALot" <sjourdan@xxxxxxxxx> wrote in message news:d3c3d690-948e-45f4-9af6-e8e6d8d32e20@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hi All,

I am stuck and could use some help. For some reason, none of our
domain users can access our webpages unless they are added to the
Administrator group on the Web server and I can't figure out why. This
just started happening recently.

We have a local group called Users that conains our Domain Users.

Here is what I have done:

1. Checked that the users gruops has access to the Web Directory -
Users - yes
IIS_WFG - yes
System - yes
Administrators - yes
Users - yes

2. Checked the authentication method for the Website
- Integrated Windows Authentication

3. Looked at the logs for a persons not in the Adminstrators groups.
Here are a few lines:
2007-12-04 21:28:28 W3SVC1786339847 GET /ts/index.html - 80 - 401
1 0
2007-12-04 21:28:28 W3SVC1786339847 GET /ts/index.html - 80 - 500
0 2148074244

So it looks like it is failing because it can't validate the user and
only works if the user is in the admin group. Anyone have any idea
why?

Thanks in advance for your help!
-SJ





.

Relevant Pages

  • Re: Performance question (IIS 6)
    ... The delay on the first request is due to interaction between IIS process ... You can do this yourself by making a request to the necessary application ... Turn off all the application pool recycling parameters except maybe the ... until you reboot the server. ...
    (microsoft.public.inetserver.iis)
  • Re: Page Cannot Be Displayed Errors
    ... not IIS, but something else. ... >>> directly on the web server, ... >>>>> I have done some additional checking in the logs. ... >>>>> either the request isn't even getting to IIS at this point, ...
    (microsoft.public.inetserver.iis)
  • Re: Page Cannot Be Displayed Errors
    ... "Jesse" wrote in message ... >> In WFetch, for Advanced Request, change to "Add Headers" and write: ... >>> directly on the web server, ... >>>>> Where can I get the IIS 6.0 Resource Kit, and how do I use WFetch? ...
    (microsoft.public.inetserver.iis)
  • Re: Page Cannot Be Displayed Errors
    ... I have remote access to the server through Remote Desktop, ... Where can I get the IIS 6.0 Resource Kit, and how do I use WFetch? ... following through with the request, ... > It sounds like you are quite close to the webserver. ...
    (microsoft.public.inetserver.iis)
  • Re: Page Cannot Be Displayed Errors
    ... In WFetch, for Advanced Request, change to "Add Headers" and write: ... > directly on the web server, ... >>> Where can I get the IIS 6.0 Resource Kit, and how do I use WFetch? ...
    (microsoft.public.inetserver.iis)