20

I have a web application deployed to Server 2008 IIS 7.5 box.

From remote it gives this error: 401 - Unauthorized: Access is denied due to invalid credentials. (remote = desktops on the same LAN)

Have tried several remote clients using different browsers, all the same result. (IE, FF, and Chrome)

Hitting the application from the desktop of the server itself works flawlessly. However I have not tried Firebug on the server desktop. I would assume it's still issuing a 401 status code yet returning the content anyway. See Update #2.

The application is using Anonymous Authentication.

The application is written in .NET 4.0 Asp.Net using the MVC framework.

Static content works fine, example: http://server.com/content/image.jpg

Sysinternals procmon returns these 2 results for each request: FAST IO DISALLOWED and PATH NOT FOUND.

I have 2 other MVC apps running fine on the same server. I have checked the security on the folders and they all match.

App runs fine on a Server 2008 IIS 7.0 box.

Nothing shows up in the Event log on the server related to this.

Pulling my hair out here, any troubleshooting tips?

UPDATE #1: This just get's more WTF as I dig.

If I click on the Application in IIS Manager -> Error Pages -> Edit Feature Settings select Detailed Errors, the app works remotely. Not leaving this on, so problem is not solved yet, its just more confusing.

UPDATE #2: Using Firebug, I see that the Status is still 401 Unauthorized, but the Response is returning the application's correct HTML.

UPDATE #3 Playing around with Failed Request Tracing, here is the WARNING Request Trace that is causing the 401:

ModuleName ManagedPipelineHandler
Notification 128
HttpStatus 401 
HttpReason Unauthorized 
HttpSubStatus 0 
ErrorCode 0 
ConfigExceptionInfo  
Notification EXECUTE_REQUEST_HANDLER 
ErrorCode The operation completed successfully. (0x0)

Update #4 Regular IIS log is showing this:

#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2010-07-20 19:17:22
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2010-07-20 19:17:22 10.10.1.10 GET /Purchasing/Home - 80 - 10.10.1.12 Mozilla/5.0+(Windows;+U;+Windows+NT+6.1;+en-US;+rv:1.9.2.6)+Gecko/20100625+Firefox/3.6.6 401 0 0 4414
4
  • Did you tried running Failed Request Tracing on the server and access the application from the remote machine. If there is a failure, you should see the cause. May 13, 2010 at 23:45
  • @vivek see my latest update
    – mxmissile
    Jul 20, 2010 at 16:53
  • ARRG!!! Got but by this again! 2 hours wasted searching for Html.RenderAction, then realized Razor uses Html.Action so my initial searches came up empty.
    – mxmissile
    Nov 15, 2011 at 16:06
  • Oh its been a couple years, guess what? Just wasted 3 hours on this morning on this AGAIN! When will I learn?!?!?!
    – mxmissile
    Dec 7, 2013 at 17:39

5 Answers 5

19

Sometimes you have to take a step back... The cause of this was I had a Html.RenderAction() in my view that called an action method that was marked with the [Authorize] attribute.

1
  • 1
    This was my problem, it was a frustrating enough to punch a panda (not that I would). Thanks mxmissile. Aug 24, 2011 at 13:08
4

Since it works locally but not remotely, it sounds to me like the anonymous user account doesn't have access to something, but your windows user does. To prove this, turn off Windows Authentication for the website and see if it breaks locally.

Whatever is breaking is likely running as your website identity instead of your app pool identity, otherwise it would break locally and remotely. My recommendation if you have 1 to 1 mappings of sites to app pools, or you have a highly trusted environment, is to set the anonymous user account to use the app pool identity. Then you don't need to worry about a 2nd user to maintain.

You mentioned process explorer. That's good for finding running info, but the tool that will likely uncover access denied errors is processmon (also from sysinternals). Try it, repro and capture, then search for the word 'denied'. It should turn up any access denied issues on disk.

4

You will have this same behavior when you have a filter for custom authorization that inherits from AuthorizeAttribute and one or more calls to OnAuthorization method , with one of them setting AuthorizationContext.Result to `HttpUnauthorizedResult'

4

For some reason this fixed my issue.

  1. Click site in IIS.
  2. Double click authentication
  3. Right click and pick Advanced settings
  4. De-select "Enable Kernel-mode authentication"
2

Did you check the settings under Authorization rules? If anyone can access this page (which seems to be your goal) make sure that you have an "Allow" rule that has "All Users" under the users column.

Then in "Authentication" make sure there are no conflicts and only Anonymous Authentication is enabled.

Hope that helps.

1
  • 1
    Allow - All Users - Inherited
    – mxmissile
    Apr 29, 2010 at 20:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .