0

my web server randomly asks for a password as though basic authentication is turned on. It's an IIS 7 web server and you have to specifically install basic authentication in the roles section. It isn't installed.

The message that pops up is "Warning: This server is requesting that your username and password be sent in an insecure manner (basic authentication without a secure connection)"

I cannot reproduce the problem but a number of customers have reported the problem and it only seems to appear to a small number of customers.

It pops up when they visit the homepage, nothing is generated by the IIS logs to indicate a password box is being served (e.g. no 401 errors etc)

Can anyone offer any advice?

Thanks

1 Answer 1

1

Try using processmon (www.sysinternals.com) to capture the issue and find out where the access denied is coming from. If you add a filter for the PID of your site's app pool you won't have too many events.

Type iisapp from the command prompt to see the app pool to PID mapping.

After you get a capture, search for the word 'denied'. It's likely that you'll find out what is causing this.

11
  • good idea Scott, only I can't seem to reproduce the problem which is making it difficult to examine! I will try your suggestion if I can reproduce the issue - thanks
    – Paul
    Mar 16, 2010 at 13:54
  • Hi Scott, I tried your suggestion in a controlled environment and it helpfully shows up a 401.2 error which is also shown in the IIS logs. The odd thing is that in the "live" error it simply doesn't stamp any 401 errors in the log. It's like my servers aren't serving this prompt up!
    – Paul
    Mar 16, 2010 at 16:39
  • Hi Paul. That can make it more difficult. Any chance that another IIS site catches some requests, or that you have a load balancer in front that might be coming into play? processmon may still be able to catch access denied errors as long as the requests are actually getting to the server. Mar 16, 2010 at 18:27
  • Hi Scott, yes we have a small load balancing set up I have a method of eliminating by using the servers browser - this uses the NLB address locally. Unfortunately the ProcessMonitor app killed my server after I left it running - ouch. It's such a random problem, when it happens it seems to happen to a few customers at a time. What is most confusing is the fact I'm not seeing any 401 errors anywhere.
    – Paul
    Mar 17, 2010 at 11:10
  • Are you saying that you can repro it locally on the nodes? If you do, does it log it in that situation? I would still be suspect of something with NLB or the servers rather than IIS. Check Event Viewer too, for any further hints. Bummer on procmon killing the server. It can generate a lot of data waiting for a repro. There is a setting to limit how many it keeps at a time, also the more narrow the filter, the longer it can run. For example, at the very least, filter by PID, but you may have to filter by the word 'denied'. It won't show the info around it, but it will show what is denied. Mar 17, 2010 at 13:59

You must log in to answer this question.