| Groups | Blog | Home |
iis security : XP SP2 - Bug with IIS Windows Authentication?!
After installing SP2 for Windows XP, I noticed that my local IIS web
site that uses Windows authentication was acting strangly. When I go to : http://localhost/mySecureSite - no login window - site is displayed http://[myIPAddress]/mySecureSite - login window - site is displayed (after very slow login) http://127.0.0.1/mySecureSite - login window - site is displayed http://mySite/mySecureSite - login window - ** access denied ** In the last test, "mySite" was defined in the hosts file on the local machine. The login windows was displayed (with the name of the local machine in the title of the dialog) however the username/password was systematically rejected!! Tests I performed: - Instead of defining mySite as 127.0.0.1 in the hosts file, I defined it as the local external IP address. No change. - Disabled the firewall (Set to "Off" in the "General" Tab of Windows Firewall). No change. - Stopped the Windows Firewall /ICS service. No change. - Rebooted. No change. - I just tried these four tests in Mozilla Firefox. They all work?!!! Is this an IE security setting problem? Any help would be appreciated,
Thanks for the responses guys.
I tried adding "mysite" to both the Trusted Sites and the Local Intranet site, but still I can not get past the login window. What I don't understand is that "mysite" resolves to 127.0.0.1. So theoretically the login window should be the same for both. However the "mysite" link rejects every login, while the link using 127.0.0.1 works just fine (logging in with USERNAME or MYCOMPUTERNAME\USERNAME). I've got an ASP page that returns the AUTH_USER server variable. It appears that I'm logging in to the appropriate account with the 3 links that do work (i.e. I can use a username/pwd other than my current logged in account). Again, with Mozilla I can access all 4 links on the local machine. Interestingly, from a remote machine (Windows 2000 on another domain) if I modify the hosts file to define "mysite" as the IP address of the XP box it works just fine. I can log in without a problem. This would appear to be an IE bug / strange security setting. A colleague of mine just (unintentionally) duplicated this scenario. Hmmm....
Hi,
Add your http://[myIPAddress]/, http://127.0.0.1, and http://mySite/ to "Local Intranet" zone and try again. I hope this helps, Mike [quoted text, click to view] "Anil" <anilr@post.com> wrote in message news:108c4151.0408180030.5d5850e2@posting.google.com... > After installing SP2 for Windows XP, I noticed that my local IIS web > site that uses Windows authentication was acting strangly. When I go > to : > > http://localhost/mySecureSite - no login window - site is displayed > http://[myIPAddress]/mySecureSite - login window - site is displayed > (after very slow login) > http://127.0.0.1/mySecureSite - login window - site is displayed > http://mySite/mySecureSite - login window - ** access denied ** > > In the last test, "mySite" was defined in the hosts file on the local > machine. The login windows was displayed (with the name of the local > machine in the title of the dialog) however the username/password was > systematically rejected!! > > > Tests I performed: > - Instead of defining mySite as 127.0.0.1 in the hosts file, I defined > it as the local external IP address. No change. > > - Disabled the firewall (Set to "Off" in the "General" Tab of Windows > Firewall). No change. > > - Stopped the Windows Firewall /ICS service. No change. > > - Rebooted. No change. > > - I just tried these four tests in Mozilla Firefox. They all work?!!! > Is this an IE security setting problem? > > > Any help would be appreciated, > Anil
Hi,
This explains why you are getting the login dialogue for <Ip address> and <127.0.0.1> http://support.microsoft.com/?id=258063 for http://mysite/ you probably need to enter your credentials as RealComputerName\Username Cheers Ken [quoted text, click to view] "Anil" <anilr@post.com> wrote in message news:108c4151.0408180030.5d5850e2@posting.google.com... > After installing SP2 for Windows XP, I noticed that my local IIS web > site that uses Windows authentication was acting strangly. When I go > to : > > http://localhost/mySecureSite - no login window - site is displayed > http://[myIPAddress]/mySecureSite - login window - site is displayed > (after very slow login) > http://127.0.0.1/mySecureSite - login window - site is displayed > http://mySite/mySecureSite - login window - ** access denied ** > > In the last test, "mySite" was defined in the hosts file on the local > machine. The login windows was displayed (with the name of the local > machine in the title of the dialog) however the username/password was > systematically rejected!! > > > Tests I performed: > - Instead of defining mySite as 127.0.0.1 in the hosts file, I defined > it as the local external IP address. No change. > > - Disabled the firewall (Set to "Off" in the "General" Tab of Windows > Firewall). No change. > > - Stopped the Windows Firewall /ICS service. No change. > > - Rebooted. No change. > > - I just tried these four tests in Mozilla Firefox. They all work?!!! > Is this an IE security setting problem? > > > Any help would be appreciated, > Anil
Yeah, I looked at the Event manager for info, but it's not very helpful
(to me at least). Here's the scoop... The Logon Failure event is as follows: Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 537 Date: 19/08/2004 Time: 10:30:28 User: NT AUTHORITY\SYSTEM Computer: WINCALL002 Description: Logon Failure: Reason: An error occurred during logon User Name: ANILR Domain: myDomain Logon Type: 3 Logon Process: 8‘|ÔúÃ Authentication Package: NTLM Workstation Name: MYMACHINE Status code: 0xC000006D Substatus code: 0xC3FC50 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. ----------------------------------------------------- The firewall information provided just before the login failure: The Windows Firewall has detected an application listening for incoming traffic. Name: lsass.exe Path: C:\WINDOWS\system32\lsass.exe Process identifier: 636 User account: SYSTEM User domain: NT AUTHORITY Service: Yes RPC server: No IP version: IPv4 IP protocol: UDP Port number: 4415 Allowed: Yes User notified: No For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. ---------------------- *** Sent via Developersdex http://www.developersdex.com ***
Please enable Logon Auditing failure on your local machine, and look in the
Windows Security event logs to see what account Windows thinks is attempting to logon (and failing). Cheers Ken [quoted text, click to view] "Anil" <anilr@post.com> wrote in message news:108c4151.0408180710.bcfa51a@posting.google.com... > Thanks for the responses guys. > > I tried adding "mysite" to both the Trusted Sites and the Local > Intranet site, but still I can not get past the login window. > > What I don't understand is that "mysite" resolves to 127.0.0.1. So > theoretically the login window should be the same for both. However > the "mysite" link rejects every login, while the link using 127.0.0.1 > works just fine (logging in with USERNAME or MYCOMPUTERNAME\USERNAME). > > I've got an ASP page that returns the AUTH_USER server variable. It > appears that I'm logging in to the appropriate account with the 3 > links that do work (i.e. I can use a username/pwd other than my > current logged in account). > > Again, with Mozilla I can access all 4 links on the local machine. > > Interestingly, from a remote machine (Windows 2000 on another domain) > if I modify the hosts file to define "mysite" as the IP address of the > XP box it works just fine. I can log in without a problem. > > This would appear to be an IE bug / strange security setting. > > A colleague of mine just (unintentionally) duplicated this scenario. > Hmmm.... > > > Can anyone confirm this as an SP2 bug?
You might want to ring PSS and see if this help
Programs that connect to IP addresses that are in the loopback address range may not work as you expect in Windows XP Service Pack 2 http://support.microsoft.com/?id=884020 -- Regards, Bernard Cheah http://www.tryiis.com/ http://support.microsoft.com/ http://www.msmvps.com/bernard/ [quoted text, click to view] "Anil" <anilr@post.com> wrote in message news:108c4151.0408180710.bcfa51a@posting.google.com... > Thanks for the responses guys. > > I tried adding "mysite" to both the Trusted Sites and the Local > Intranet site, but still I can not get past the login window. > > What I don't understand is that "mysite" resolves to 127.0.0.1. So > theoretically the login window should be the same for both. However > the "mysite" link rejects every login, while the link using 127.0.0.1 > works just fine (logging in with USERNAME or MYCOMPUTERNAME\USERNAME). > > I've got an ASP page that returns the AUTH_USER server variable. It > appears that I'm logging in to the appropriate account with the 3 > links that do work (i.e. I can use a username/pwd other than my > current logged in account). > > Again, with Mozilla I can access all 4 links on the local machine. > > Interestingly, from a remote machine (Windows 2000 on another domain) > if I modify the hosts file to define "mysite" as the IP address of the > XP box it works just fine. I can log in without a problem. > > This would appear to be an IE bug / strange security setting. > > A colleague of mine just (unintentionally) duplicated this scenario. > Hmmm.... > > > Can anyone confirm this as an SP2 bug?
[quoted text, click to view]
"Anil Rhemtulla" <anilr@post.com> wrote in message news:eLeeMnchEHA.1652@TK2MSFTNGP09.phx.gbl... > User Name: ANILR > Domain: myDomain Try to logon as Local instead of the "myDomain" see what it does. I have XP/SP2 (issued on 8/10/04) installed on my XP Pro and it works fine here with FireWall enabled (fully) and no settings were altered. John
John,
You managed to log on to a local web site with Windows Authentication using a host name in the URL (which was defined in your HOSTS file)? As I mentioned, I've tried both local and domain username/pwd combinations, and I can successfuly log in to the web site if I replace the Host name with either the IP address or "localhost". I have defined the Host name correctly (tested using "ping HostName") as either the IP address or 127.0.0.1. But neither allow me to log in. Here's the interesting part: IT WORK IN MOZILLA FIREFOX ! So for some reason, the IE is screwing up the windows Authentication. I've tried adding HostName to my trusted web sites in IE to see if that helped out, but it did not. John, can you please confirm your test was similar. Cheers,
Did you check the KB article that Bernard posted? If this is an XP SP2
machine, you can get a hotfix from PSS (there is no charge, just cite the KB article). Cheers Ken [quoted text, click to view] "Anil" <anilr@post.com> wrote in message news:108c4151.0408240001.387efe58@posting.google.com... > John, > > You managed to log on to a local web site with Windows Authentication > using a host name in the URL (which was defined in your HOSTS file)? > > As I mentioned, I've tried both local and domain username/pwd > combinations, and I can successfuly log in to the web site if I > replace the Host name with either the IP address or "localhost". > > I have defined the Host name correctly (tested using "ping HostName") > as either the IP address or 127.0.0.1. But neither allow me to log in. > > Here's the interesting part: > IT WORK IN MOZILLA FIREFOX ! > > So for some reason, the IE is screwing up the windows Authentication. > I've tried adding HostName to my trusted web sites in IE to see if > that helped out, but it did not. > > John, can you please confirm your test was similar. > > Cheers, > Anil
Thaanks Bernanrd (and Ken) for the KB article info,
It looks like it's related, but I'm not convinced. In any case, I spent 20 minutes on hold with Microsoft France until I finally gave up and unistalled the service pack. :( Perhaps, on a rainy day, I'll get the PSS hotfix and try it all again... but for now I need a working computer! Cheers,
Don't see what you're looking for? Try a search.
|
June 2003
July 2003
August 2003
September 2003
October 2003
November 2003
December 2003
January 2004
February 2004
March 2004
April 2004
May 2004
June 2004
July 2004
August 2004
September 2004
October 2004
November 2004
December 2004
January 2005
February 2005
March 2005
April 2005
May 2005
June 2005
July 2005
August 2005
September 2005
October 2005
November 2005
December 2005
January 2006
February 2006
March 2006
April 2006
May 2006
June 2006
July 2006
August 2006
September 2006
October 2006
November 2006
December 2006
January 2007
February 2007
March 2007
April 2007
May 2007
June 2007
July 2007
August 2007
September 2007
October 2007
November 2007
December 2007
January 2008
February 2008
March 2008
April 2008
May 2008
June 2008
| home · blog · groups | Questions? Comments? Contact the dn |