iis security: I like to secure my ASP with either a username and
password or a client certificate. Therefore I have
set "require SSL" and "accept client certificates".

However, my script fails for the first document that I
send if I use a username and password. The error on the
client is: "There is a security problem.". There is no
entry in the IIS server log file.

There is no problem when I supply a client certificate.
Also, there is no problem if I set "ignore client
certificates".

I have tried with MSXML3 SP2 and MSXML4 SP2 without
any difference in behaviour. Can someone explain why
I get an error for the first message?

<job id="eSCLSend">
<script language="JScript">

submitDocument("document1.xml");
submitDocument("document2.xml");

function submitDocument(inputdoc) {
var httpOb = new ActiveXObject("MSXML2.XMLHTTP");

httpOb.open
("POST", "https://servername/ReceiveXML.asp",
false, "username", "password");
httpOb.setRequestHeader("Content-Type", "text/xml");

var fso, ts, msg;
var ForReading = 1;
fso = new ActiveXObject("Scripting.FileSystemObject");
ts = fso.OpenTextFile(inputdoc, ForReading);
msg = ts.ReadAll();
ts.Close();

try {
httpOb.send(msg);
} catch(e)
WScript.Echo(e.number);
WScript.Echo(e.description);
}

WScript.Echo(httpOb.statusText);
WScript.Echo(httpOb.responseText);
}
</script>

Hi Martin,

So far as I know on this issue, XMLHTTP starts to support SSL with client certificates from XML 3.0 sp1. There is one kb article which introduce
detailed information abotu this issue for you. Please go to:
301429 HOWTO: Install Client Certificate on IIS Server for ServerXMLHTTP
http://support.microsoft.com/?id=301429

Please feel free to let me know if you have any further questions.

Does this answer your question? Thank you for using Microsoft NewsGroup!

Wei-Dong Xu
Microsoft Product Support Services
Get Secure! - www.microsoft.com/security
This posting is provided "AS IS" with no warranties, and confers no rights.

Hi,

I have basic authentication enabled. File security is
enabled and works, because with "ignore client
certificates" it works without problems.

Kind regards,

Martin
[quoted text, click to view]
you should check which authentication method you are
using. It is suggested that you
[quoted text, click to view]
that you can take full advantage of windows security
features. Furthermore, since you
[quoted text, click to view]
authentication will also help you a lot. Then, you can
also check whether the user account
[quoted text, click to view]