Access denied in Internet Explorer

Question

User-1234995641 posted

 Hello,

I'm trying to deploy a Web-Application. Unfortunately I keep getting an access denied error with Internet Explorer, when I turn off anonymous access and only enable windows integrated authentication. There is no problem with Firefox. For testing, I've allowed full control to everyone on the root-directory (and all subdirectories) and allowed all users in the web.config file.

      <authentication mode="Windows" />
      <authorization>
        <allow users="*" />
      </authorization> 

 I've red something about problems with the indexing-service, but I've disabled it. Windows integrated authentication ist enabled in Internet Explorer.
I'm testing on the local computer and this computer is joined to a domain.

Does anybody have any idea why this is happening?
 

 

Answer 1

User-583866104 posted

 In IE go to internet options-->Advanced-->Security-->Enable Integrated Windows Authentication (make sure it is checked)

IE options --> Security --> Custom Level --> scroll to the end of the list check "Automatic logon with current username and password"

If this doesn't solve it. Add your site to the trusted sites list in IE options-->Security

hth 

PS: I"m assuming this is an intranet website and the client machine is in the same domain as the web server. 

Answer 2

User-1234995641 posted

I've checked this and added the site to the trusted sites. It still doesn't work.

I've enabled the logging of failed authentications in the local polices, but there were no entries in the security eventlog.
Then, I've installed Filemon and checked if there are any "Access denied" messages --> no, there weren't.
Same procedure with Regmon, no suspicious errors. :(

The only thing I've found were some lines with 401 errors in the IIS log, but I don't know where they come from. 

 Edit: It's getting stranger and stranger :(

This is the IIS Log when I'm accessing the site successfully with Firefox (I've changed the domain an username in this output). First it asked for credentials, I've entered it and the page displayed correctly.
But why are there allways these 401.1 and 401.2 Errors and then it loads successfully?? (Look here for status codes: http://support.microsoft.com/kb/318380)
 

#Software: Microsoft Internet Information Services 6.0
#Version: 1.0
#Date: 2007-09-27 08:10:48
#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
2007-09-27 08:10:48 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 - 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 401 2 2148074254
2007-09-27 08:11:00 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 - 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 401 1 0
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 domain\user 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 200 0 0
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /Frontend/css/account_verwaltung.css - 80 - 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 401 2 2148074254
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /Frontend/css/account_verwaltung.css - 80 - 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 401 1 0
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /Frontend/css/account_verwaltung.css - 80 domain\user 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 200 0 0
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /WebResource.axd d=Ejo-ZFYBP0K8wX8kaAJQew2&t=633211744862343750 80 - 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 401 2 2148074254
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /WebResource.axd d=Ejo-ZFYBP0K8wX8kaAJQew2&t=633211744862343750 80 - 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 401 1 0
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /WebResource.axd d=Ejo-ZFYBP0K8wX8kaAJQew2&t=633211744862343750 80 domain\user
192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 200 0 0
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /ScriptResource.axd d=83BN-v9ahDKjIQwda3kOSxSA_n8Bp4RuGYdkIooYm3GGMNue_F7_S0eU7nXCZdgMNOwpFNKgGx6XI12qNOgVTeAe4PRSaptihqeTkVYydFk1&t=633258063018593750 80 - 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 401 2 2148074254
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /ScriptResource.axd d=83BN-v9ahDKjIQwda3kOSxSA_n8Bp4RuGYdkIooYm3GGMNue_F7_S0eU7nXCZdgMNOwpFNKgGx6XI12qNOgVTeAe4PRSaptihqeTkVYydFk1&t=633258063018593750 80 - 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 401 1 0
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /ScriptResource.axd d=83BN-v9ahDKjIQwda3kOSxSA_n8Bp4RuGYdkIooYm3GGMNue_F7_S0eU7nXCZdgMNOwpFNKgGx6XI12qNOgVTeAe4PRSaptihqeTkVYydFk1&t=633258063018593750 80 domain\user 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 200 0 0
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /ScriptResource.axd d=83BN-v9ahDKjIQwda3kOSxSA_n8Bp4RuGYdkIooYm3GGMNue_F7_S0eU7nXCZdgMNOwpFNKgGx6XI12qNOgVTaWyGbYvrncmBE_J8igQH381&t=633258063018593750 80 - 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 401 2 2148074254
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /ScriptResource.axd d=83BN-v9ahDKjIQwda3kOSxSA_n8Bp4RuGYdkIooYm3GGMNue_F7_S0eU7nXCZdgMNOwpFNKgGx6XI12qNOgVTaWyGbYvrncmBE_J8igQH381&t=633258063018593750 80 - 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 401 1 0
2007-09-27 08:11:07 W3SVC1355107438 192.168.0.5 GET /ScriptResource.axd d=83BN-v9ahDKjIQwda3kOSxSA_n8Bp4RuGYdkIooYm3GGMNue_F7_S0eU7nXCZdgMNOwpFNKgGx6XI12qNOgVTaWyGbYvrncmBE_J8igQH381&t=633258063018593750 80 domain\user 192.168.0.5 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+de;+rv:1.8.1.7)+Gecko/20070914+Firefox/2.0.0.7 200 0 0
 

And here's the Log when I open the site with Internet Explorer and enter the credentials until I get the 401 errorpage.

#Software: Microsoft Internet Information Services 6.0
#Version: 1.0
#Date: 2007-09-27 08:31:56
#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
2007-09-27 08:31:56 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 - 192.168.0.5 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 401 2 2148074254
2007-09-27 08:31:56 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 - 192.168.0.5 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 401 1 0
2007-09-27 08:31:56 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 - 192.168.0.5 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 401 1 2148074252
2007-09-27 08:32:11 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 - 192.168.0.5 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 401 1 0
2007-09-27 08:32:11 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 - 192.168.0.5 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 401 1 2148074252
2007-09-27 08:32:12 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 - 192.168.0.5 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 401 1 0
2007-09-27 08:32:12 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 - 192.168.0.5 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 401 1 2148074252
2007-09-27 08:32:12 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 - 192.168.0.5 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 401 1 0
2007-09-27 08:32:12 W3SVC1355107438 192.168.0.5 GET /Frontend/AdminPwReset.aspx - 80 - 192.168.0.5 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.2;+.NET+CLR+1.1.4322;+.NET+CLR+2.0.50727;+.NET+CLR+3.0.04506.30) 401 1 2148074252

 

 

Answer 3

User1451898110 posted

Hi,

Add <deny users="?"/> to your authorization element so it looks like this:

        <authorization>
            <deny users="?"/>
            <allow users="*"/>
        </authorization>

Does it work then?

 
Regards
 

Answer 4

User-1234995641 posted

Doesn't change anything.
It still works with Firefox but not with IE.
 

Answer 5

User1451898110 posted

This is a wild guess but check this:

Control Panel -> User Accounts -> Advanced -> Manage Passwords

Are there any passwords for your application stored here?

Regards.
 

Answer 6

User-583866104 posted

 There is a tool by MS called AuthDiag to troubleshoot authentication problems (http://www.microsoft.com/downloads/details.aspx?FamilyID=e90fe777-4a21-4066-bd22-b931f7572e9a&DisplayLang=en)

run this against your site. hopefully it will give us more clues to go on.

fyi when using intergrated authentication you will get an initial 401 unauthorized (this is the server challenging the client to send the credentials), next the client would send in the authentication ticket which the server uses to authenticate.

Looking at the IIS logs it looks like the second attempt fails with 401.1 (login failed) so i'm guessing the user credentials sent is incorrect for the server to authenticate. Like said earlier make sure u clear ur credential cache. log off and log back in and try again.

 

 

Answer 7

User-1234995641 posted

The problem is solved. HTTP Keep-Alives weren't enabled. Don't know why, but it seams so be needed for integrated authentication.

Thank you for your effort! 

Answer 8

User1596751078 posted

My issue seems directly related to whether or not Integrated Authentication is enabled in IE Advanced settings.  With IA enabled users get the 401.1 but disabled I get logged directly in.  Any clues?  As with yves3 this only happens to IE users, those 'Nix guys and thier FireFox browsers don't have any issues.

 

Web.config:

      <authorization>
        <allow roles="Domain\Group1" />
        <allow roles="Domain\Group2"/>
        <allow roles="Domain\Group3" />
        <allow roles="Domain\Group4"/>
        <deny users="?"/>
      </authorization>

Answer 9

User-1835398548 posted

yves3,

 I had a similar issue, but my solution was different.  The two tools I used to reslove my issue were Fiddler 2 and Auth Diagnostics 1.0 for IIS.

my solution : When using IIS 6.0 with Integrated Security, get Access Denied from IE 6.0