Search results matching tag 'ie7'

Kerberos Authentication mystery with IE7

filip.goris@flip.be — Wed, 16 Sep 2009 16:57:17 GMT

We have the most strange situation here when IE7 clients try to authenticate on an IIS6-based intranet application. I hope somebody can help me explain.

Our .asp application is running in domain "belgium.local". Integrated Windows authentication works fine for users in that domain. Users in domain "holland.local" however get a 401 error after a loooong timeout when trying to access the app. Their event logs show LsaSrv errors 40960 and 40961, which tells me it's a Kerberos-thing. There's a mutual trust between belgium.local and holland.local.

We've been troubleshooting in all directions and installed Firefox. Firefox showed us a login box, which told us it was failing over to Basic Authentication. That seemed right since it doesn't use Integrated Authentication until you tell it to. So we told it to use Kerberos by adding domain "belgium.local" to network.negotiate-auth.trusted-uris (which is about the same as enabling Integrated Windows authentication in IE7 and adding the site to my Local Intranet Zone. Cfr. http://grolmsnet.de/kerbtut/firefox.html for example.)

Now here's the odd part. After making this configuration change in Firefox, IE7 running on the same client computer will work too.
"Ah, but that's normal" I hear you say, "because the Kerberos ticket is still there and valid."
The strange thing is it will continue to work after I use Kerbtray to purge the tickets. My ticket for HTTP/app.belgium.local will show up again as soon as I visit the site with IE7. It is as if IE7 uses the Firefox configuration in some way to retrieve a ticket.

The really scary part is this: after I restore the Firefox configuration back to normal (e.g. delete all domains from the network.negotiate-auth.delegation-uris setting), IE7 will continue to work!? It is as if somehow I showed it how to get at ticket when I configured Firefox, and it "remembers" this now.

Can somebody tell me what is happening? I would like to get this to work without installing and removing Firefox on all my clients ;)

Smooth Stream 4001 Error From ASP.NET MVC Page

theregit — Thu, 18 Jun 2009 18:58:10 GMT

Hello,

I am trying to use IIS Smooth Stream to deliver some video content to our customers and I need to protect the video content behind a secured portal. I was able to get IIS Smooth Stream installed and able to use Expression Encoder to encode a video. I used the Big Bunny Default.html page as an example and was able to get a Video.html page to deliver my content via Smooth Stream.

However, when I put the EXACT same HTML that works on the Video.html site into a page that I generated with ASP.NET MVC I get the following error:

System.Exception: 4001 An error has occurred. Requires output to be hsoted on a web server running IIS 7.0 with the Smooth Streaming handler installed and a Silverlight 2 template that supports Smooth Streaming.

Both pages that work and don't work are on the same web server in the same domain. For reference:

http://<portalurl>/Video.html (works)

but

http://<portalurl>/Videos/1 (ASP.NET MVC - doesn't work).

Both of these pages have the <object> tag from the Default.html in the Big Bunny example with the url's changed. Like I said the same exact <object> tag works from the .html page but not the ASP.NET MVC generated page. I thought this would be a client side technology? Why does it matter how I get the <object> tag to the browser?

Any ideas would be much appreciated.

Thanks.

theregit

Blank Post from ie7

azzteroid — Fri, 03 Apr 2009 05:14:44 GMT

Hi we are currently experiencing issues with ie7 posting not form data to our server.

With .net trace turned on we have captured one of these error posts and can see that the HTTP_CONTENT_LENGTH is 0. We are running IIS 6 and have a mixture of classic asp and asp.net applications.

We have been unable to replicate this error on any of the test machines we have tried so far. This error only seems to be experienced by particular clients. The number of people experiencing this issue is increasing as more of our clients migrate to vista.

The main customer experiencing the issue runs ISA 2004 as their proxy server.

The error also presents itself inconsistently within affected organisations with some users experiencing the errors and other not. With those experiencing the error not even experiencing it every time.

Thanks in Advance

403.7 64 on IIS 6 on both XP 64 and server 2003 R2 64

Carrots — Mon, 03 Nov 2008 15:01:01 GMT

In the IIS logs, our client has found a bunch of 403.7 64 's being logged. Most of them are to /VirtualDirectoryName, for example:

2008-10-30 06:41:00 W3SVC3 xxx.xxx.xxx.xxx GET /VirtualDirectoryName - 443 - xxx.xxx.xxx.xxx Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+2.0.50727;+.NET+CLR+1.1.4322;+.NET+CLR+3.0.04506
.30;+.NET+CLR+3.0.04506.648;+.NET+CLR+3.5.21022) 403 7 64

These happen quite often, sometimes 4 or so requests in a row.
Directory browsing is disabled on the sites, and the default page is set to default.htm which exists, so theoretically, there should be no requests for the path.
I have enabled schannel logging, but couldnt find one matching the timestamp in IIS. For example, in IIS we have one for 2008-10-30 11:49:50, and in event viewer we have one for 11:49:52 and one for 11:49:45. I also couldnt find a patter that makes it look like the one is trailing the other by a couple of seconds.

All the IIS requests are on port 443, none are on 80.

Schannel logs information events, but no warnings.
The client confirmed that the system logs and IIS logs were from the same server.

They run Windows 2003 x64 R2 on a NLB cluster. The machines in the testing environment is a single machine only.
I am able to intermittently reproduce it on my own environment (XP 64). One out of 20 times doing the exact same actions will give me the error in the logs. The error does not affect the user at all.

Testers currently test on Windows XP 32, with IE6, IE7 and Firefox, using software certs, or in some cases USB tokens. I replicated using a software cert.

Now this does not sound like something I should be spending my time on, but the client is being audited, and this has been raised as a concern by the auditing company.

FirFox and IE targetting IIS 7.0

sammy_1 — Wed, 17 Sep 2008 20:36:35 GMT

I see different behavior for IE and FirFox when target the same application when the WebServer is IIS 7.0, but according to the header analyzer response object is different so I guess IIS might have something to do with it, especially apache is working fine

On FirFOX
GET /html/scripts/cookie.js HTTP/1.1

HTTP/1.x 304 Not Modified
Last-Modified: Mon, 23 Jul 2001 15:01:44 GMT
Accept-Ranges: bytes
Etag: "808f33638813c11:0"
Server: Microsoft-IIS/7.0
Date: Wed, 25 Jul 2001 19:19:44 GMT

But On IE
Content-Length: 2844
HTTP/1.1 200 OK
Content-Type: application/x-javascript
Last-Modified: Mon, 23 Jul 2001 15:01:44 GMT
Accept-Ranges: bytes
ETag: "808f33638813c11:0"
Server: Microsoft-IIS/7.0
Date: Wed, 25 Jul 2001 19:40:13 GMT
Content-Length: 2844

Would any one know what HTTP/1.x 304 mean? and why IIS making sending different response? any setting within IIS to make JavaScript consistent, like a compression setting or even a chunking or GZIP ?

How can I clear saved creds in IE?

ssg31415926 — Tue, 05 Aug 2008 20:01:04 GMT

I had a security problem accessing an IIS site I'd created - I was getting the IE credentials prompt.

During the process of working it out, I entered my server admin creds and accidentally clicked "Remember my password" and clicked OK before I could stop myself. In order to break the cycle of IE using my server creds, I ended up having to change my server account password.

So, now I'm back to being prompted for creds but IE is pre-filling the "User name:" field with my server admin ID. And, prior to this, it's submitting my server creds to the server. I know this because I can see Security event 529 "Unknown user name or bad password" for my server creds every time I try to access the site.

How can I clear these saved creds from Internet Explorer? I'm using IE7.

Internet Explorer + PHP in FastCGI = fail, apparently

dpadular — Tue, 27 May 2008 21:00:44 GMT

Hi,

I am posting this here because after searching and searching this seems to be an IE+IIS+FastCGI problem.

I am running PHP as a FastCGI module on Windows Vista x64 Home Premium. Viewing local pages and everything works absolutely great in Firefox, but Internet Explorer has problems. On the first load, I get the generic "can not display this page" error (even with friendly errors turned OFF). If I refresh that page, SOMETIMES I will get a partially-loaded page at a seemingly random byte length. These results basically alternate between error/partially loaded upon each subsequent refresh.

Images on localhost in IE? Perfect. Stylesheets? Perfect. Standalone HTML files? Perfect. Only when I try to access a file processing by PHP does the error occur. Even something as simple as a phpinfo() page, OR a basic HTML simply renamed as a PHP file.

And again, it all looks peachy in Firefox.

What in the world is going on? Please, any help is greatly appreciated. This is killing my test environment.

Daniel

Playlist and Vista

aryden.bk@gmail.com — Thu, 15 May 2008 09:42:58 GMT

Hello all, I recently installed Web PLaylist to my IIS 7 test machine to test its functionality before any live deployment and I am having a very strange issue.

4 computers >> 2- IE 7/firefox3 on XP sp3, 1 IE7/firefox3 Vista sp1, and 1- Safari OSx.5

the current playlist is serving an mp3. both xp machines using IE7 & firefox 3 connect and play the file perfectly! However, the Vista machine with Firefox 3 works, but using IE7 returns 404 file not found when navigating using an html link, and a cannot find media error when imputting the url to media player. Safari grabs the file and just hangs, but that is easily fixable.

any suggestions on the vista IE7 issue? i have been beating my brains to try to figure this one out. I killed the firewalls, i varied ports, i made html, php, and jscript pages to serve links to the files but still a no-go when using Vista.

Re: Unable to open the Web...You are not authorized to perform the current operation

ssg31415926 — Fri, 03 Aug 2007 10:19:41 GMT

I've confirmed that deleting the SPNs sets me back to where I was:

Accessing the page using IE puts up an Authentication dialog which refuses network creds (but allows a local admin on the server to see the page).
Opening the web with VS2005 works okay.

Unable to open the Web...You are not authorized to perform the current operation

ssg31415926 — Wed, 01 Aug 2007 13:29:14 GMT

I can't edit my web - I get an IE authentication dialog and no credentials work and then I get the error: "Unable to open the Web http://server/appname. You are not authorized to perform the current operation". My account is a local admin on the server.

Background:

I'm using IIS6 on Win2003 R2 to host a few ASP.NET pages I've written. I created the 'site' (not sure of the terminology - is it a virtual directory?) with VS2005 in the Default Web Site (which has FPSE configured). The 'site' is configured to use an Application Pool which uses a network account, as it needs to query Active Directory. The test site was working and the next step was to add security - I need to check the group membership of the user running the pages so I decided to uncheck the "Enable anonymous access" box - "Integrated Windows authentication" is selected. Now, when I tried to access the pages, I got an IE authentication dialog which isn't what I wanted. I did some research and discovered that with AppPools using network accounts, you need SPNs - the server had two, one which used the server name and one which used the fully qualified DNS server name, so I set up two similar SPNs for the App Pool account. After this, the IE authentication dialog went away.

Today, I went to make a change to a page and tried to open the site with Visual Studio. Instead of it opening like normal, I got an IE authentication dialog. I submitted my network credentials but it came straight back. No other creds would work. When I cancelled it, I got the error: "Unable to open the Web http://server/appname. You are not authorized to perform the current operation". The account with which I'm logged onto the workstation is a local admin on the server.

The server is patched to a recent level. I've tried rebooting it and my workstation. I've tryed All tasks > Recalculate Server Extensions 2002 Web but I can't get past the IE authentication window that appears. None of my IDs work (including Domain Admin).