IIS 7 and Above
Authentication problems / 401.1 error after installing NDES (MSCEP Ap...
Last post Dec 13, 2013 09:04 AM by Perkinsville
Jan 09, 2013 09:47 AM|_dtr|LINK
I installed the NDES Server on a Windows Server 2008 R2 Datacenter machine. The access to the webservice works fine for the following URLS (using IE):
However, if I try to use the IP Adress or use a different browser like firefox, access fails after entering the right credentials three times and I get an 401.1 error.
What do I need to change to get it up and running? I've already tried everything, but I'm no ISS expert.
Thanks a lot,
Jan 09, 2013 09:55 AM|Perkinsville|LINK
If you are using Windows Authentication then it will not work with an IP address. You cannot create an SPN for an IP address.
I do not know much about FF, sorry.
Jan 09, 2013 10:51 AM|_dtr|LINK
thanks for your answer. Can I change the authentication type for an application pool?
for your information: i want to integrate the NDES service with a 3rd party MDM solution (Mobile Iron) - but authentication fails. So I though: if the authentication works with Firefox (or every other browser except IE), it should work with every other system.
If my informations are correct, I need to change the IIS settings to basic authentication in order to integrate Mobile Iron and NDES.
Any thoughts on that?
Dec 13, 2013 09:04 AM|Perkinsville|LINK
It is good practice to have 1 web site / virtual directory per application pool. So, if that is the case then you can set the authentication per application pool.
I use this as a good checklist for troubleshooting Kerberos issues.
http://blogs.msdn.com/b/friis/archive/2009/12/31/things-to-check-when-kerberos-authentication-fails-using-iis-ie.aspx, there are some tips in there specific to IE.
Basic authentication is an OK option as long as you send the communication using HTTPS. This is becasue the user id and password is sent in clear text otherwise.
If basic works and not Kerberos, it is likely something to do with the SPN and/or domain trusts.