Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to bind a IIS web site (Team Foundation Services 2010) to a subdomain, which is causing authentication errors. First I'll explain what I've done to set it up. This is the fist time I do this, so please correct me if I'm wrong.

The web server is a stand-alone Windows Server 2008 R2 x64, running IIS7 with .NET Framework 4.

I have the following A-records, pointing to my server:

  • server.mydomain.com
  • *.server.mydomain.com

So all subdomains of server.mydomain.com points to the server. In IIS7 I have a web site (TFS 2010) on port 8080, with a virtual directory (named tfs) that is using Windows Authentication.

I have one binding on the web site pointing to all unassigned IP addresses, port 8080 and having a host name of tfs.server.mydomain.com.

Now, shouldn't I be able to access the virtual directory through:

http://tfs.server.mydomain.com/tfs

That is not working. However, I can access it through:

http://tfs.server.mydomain.com:8080/tfs

But, it won't let me authenticate using a Windows account (Server\Username). A windows account that I can authenticate with, when accessing the site through http://localhost:8080/tfs.

What am I missing here?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

Try Method 2 specified here http://support.microsoft.com/kb/896861. Do not try method 1 on a production machine.

share|improve this answer
1  
This is the answer for me. It fixed external and internal addresses. –  Rick Ratayczak Apr 21 '10 at 19:47
    
Thank you very much. Method two in the link above, fixed the problem. –  Tommy Jakobsen Apr 23 '10 at 7:24
add comment

I'm not sure if this was a typo or not, but as you don't seem to have your site listening on port 80, http://tfs.server.mydomain.com(:80)/tfs will not work.

Regarding authentication - any chance that this box is also a domain controller?

share|improve this answer
    
Okay, so I need the :8080. I was hoping to omit that. But I still have the authentication problem. No, the server is not a DC. It's a stand-alone server, and not even in a domain. –  Tommy Jakobsen Apr 20 '10 at 18:55
    
I would recommend that you enable auditing of logon failures and check the security event log. 1)start - run - secpol.msc 2)local policies\audit policy 3)audit logon events - success, failure 4)Open an admin cmd prmpot, type gpupdate /force 5) try again (you will fail), run eventvwr, navigate to the security event log, and look at the failures. –  JohnW Apr 20 '10 at 19:37
    
I will try that later today. But what I've noticed is that I can authenticate when accessing tfs.server.mydomain.com:8080/tfs from remote (over the internet). Only when accessing the url from the server, it won't let me authenticate. –  Tommy Jakobsen Apr 21 '10 at 13:16
    
See the Method 2 above, it worked for me Tommy. –  Rick Ratayczak Apr 21 '10 at 19:47
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.