« Previous Next »

• 06-17-2009, 8:31 AM

  sparkymark75 Joined on 06-17-2009, 12:21 PM Posts 6

  Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact I've migrated a few ASP.NET 2 pages from a development server to production and configured them the same. However I can't get access to the production pages, with the error in the subject of this post being returned after 3 prompts for credentials. The web server is a W2K3 SP2 server. The website has a hostname setup and associated with it and DNS is configured appropriately. The website has it's own application pool which uses a domain account. The domain account being used is a member of the local IIS_WPG group and is also being used without problem in another application pool on the same server. The website has been configured to use Windows Authentication and the web.config file is also set to use this. I did initially think that I may need to follow the MS KB article which details how to perform the DisableLoopbackCheck registry change but I have other websites on this server configured in a similar manner (domain account for apppool, hostname used on site) and they function without issue.

  Tags: iisunauthorized401.1host

• 06-17-2009, 9:53 AM

  In reply to

  ganeshanekar Joined on 11-15-2006, 12:29 AM India Posts 532

  Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact This still may be a permissions issue may be on web content. Ensure "Authenticated Users" are added READ permissions on web content. Download Procmon from www.sysinternals.com and reproduce the issue and check for "Access Denied" errors and fix those. If it does not help, enable Failure auditing from Local GP and check security event logs for failures. HTH. ~ Ganesh

• 06-17-2009, 9:57 AM

  In reply to

  Paul Lynch Joined on 05-24-2006, 9:41 AM UK Posts 1,247

  Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact Hi, Do the other web sites that use a domain account for their app pool use Integrated Windows Authentication ? The symptoms you describe sound like a Kerberos authentication failure. Refer to this KB article for an explanation of what is happening and how to fix it : How to use SPNs when you configure Web applications that are hosted on IIS 6.0 Regards, Paul Lynch | www.iisadmin.co.uk

• 06-17-2009, 10:02 AM

  In reply to

  Paul Lynch Joined on 05-24-2006, 9:41 AM UK Posts 1,247	Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact ganeshanekar: This still may be a permissions issue may be on web content. Ensure "Authenticated Users" are added READ permissions on web content   If it was a permissions issue you would see a 401.3 not a 401.1 Regards, Paul Lynch | www.iisadmin.co.uk

• 06-17-2009, 10:08 AM

  In reply to

  ganeshanekar Joined on 11-15-2006, 12:29 AM India Posts 532	Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact You are Right!!  Paul. Yeah, this may be SPN issue, but check Failure Auditing, that will give you clue if this is kerberos failure. ~ Ganesh

• 06-17-2009, 12:17 PM

  In reply to

  sparkymark75 Joined on 06-17-2009, 12:21 PM Posts 6	Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact Yes, they use Integrated Windows Authentication. I've been in a meeting all afternoon but will check the article posted and report back. Thanks.

• 06-18-2009, 7:32 AM

  In reply to

  sparkymark75 Joined on 06-17-2009, 12:21 PM Posts 6

  Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact I've ran setspn to check the spn's set for the domain account and the hostname is listed among them; HTTP/biz I've checked the NTAuthenticationProviders setting for the site in IIS and there's no value for the property which according to KB 215383, means it will default to Negotiate, NTLM. Any other ideas?

• 06-18-2009, 8:54 AM

  In reply to

  Paul Lynch Joined on 05-24-2006, 9:41 AM UK Posts 1,247

  Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact sparkymark75: I've ran setspn to check the spn's set for the domain account and the hostname is listed among them; HTTP/biz   In your first post you said, "The website has a hostname setup and associated with it and DNS is configured appropriately" Does the hostname that the clients are typing into their browsers match any of the SPN's that you have got configured for your domain account ? Is that hostname a DNS CNAME or is it an A record ? Is the web content for your application stored locally or remotely ? Regards, Paul Lynch | www.iisadmin.co.uk

• 06-18-2009, 9:20 AM

  In reply to

  sparkymark75 Joined on 06-17-2009, 12:21 PM Posts 6

  Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact Does the hostname that the clients are typing into their browsers match any of the SPN's that you have got configured for your domain account ? The hostname, biz, matches the SPN HTTP/biz Is that hostname a DNS CNAME or is it an A record ? According to my colleague it's a CNAME. Is the web content for your application stored locally or remotely ? The content is stored locally on the server.

• 06-18-2009, 9:42 AM

  In reply to

  Paul Lynch Joined on 05-24-2006, 9:41 AM UK Posts 1,247

  Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact Hi, OK, if you're using a CNAME its possible that your client machines are not requesting the correct service prinipal name when they connect - a Wireshark capture would show this. However, there are two possible ways to resolve this. You can either use a DNS A record instead of a CNAME or you can try applying this hotfix : Error message in Internet Explorer when you try to access a Web site that requires Kerberos authentication on a Windows XP-based computer: "HTTP Error 401 - Unauthorized: Access is denied due to invalid credentials" This may explain why your clients are not falling back to NTLM. Regards, Paul Lynch | www.iisadmin.co.uk

• 06-18-2009, 9:53 AM

  In reply to

  ganeshanekar Joined on 11-15-2006, 12:29 AM India Posts 532

  Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact To check if this is SPN issue or Kerberos issue, You may want to use following Tool which would help to narrow down this problem. DelegConfig v1 (Delegation / Kerberos Configuration Tool) http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1434 Install this tool and Run it. HTH. ~ Ganesh

• 06-18-2009, 10:57 AM

  In reply to

  sparkymark75 Joined on 06-17-2009, 12:21 PM Posts 6	Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact Thanks Paul. Looks like this could be the issue. Forcing the site to use NTLM seems to work as an interim solution. I'll pass this onto the guys that deal with DNS. Thanks for your help.

• 06-18-2009, 10:57 AM

  In reply to

  sparkymark75 Joined on 06-17-2009, 12:21 PM Posts 6	Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact Thanks for participating and offering advice.

• 06-18-2009, 1:48 PM

  In reply to

  Paul Lynch Joined on 05-24-2006, 9:41 AM UK Posts 1,247	Re: Yet another HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials. Reply Contact Hi, OK, please let us know how you get on and what action you take to fix the issue. I'm sure others would be interested to know about this problem. Regards, Paul Lynch | www.iisadmin.co.uk