Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a web application deployed to Server 2008 IIS 7.5 box.

From remote it gives this error: 401 - Unauthorized: Access is denied due to invalid credentials. (remote = desktops on the same LAN)

Have tried several remote clients using different browsers, all the same result. (IE, FF, and Chrome)

Hitting the application from the desktop of the server itself works flawlessly. However I have not tried Firebug on the server desktop. I would assume it's still issuing a 401 status code yet returning the content anyway. See Update #2.

The application is using Anonymous Authentication.

The application is written in .NET 4.0 Asp.Net using the MVC framework.

Static content works fine, example: http://server.com/content/image.jpg

Sysinternals procmon returns these 2 results for each request: FAST IO DISALLOWED and PATH NOT FOUND.

I have 2 other MVC apps running fine on the same server. I have checked the security on the folders and they all match.

App runs fine on a Server 2008 IIS 7.0 box.

Nothing shows up in the Event log on the server related to this.

Pulling my hair out here, any troubleshooting tips?

UPDATE #1: This just get's more WTF as I dig.

If I click on the Application in IIS Manager -> Error Pages -> Edit Feature Settings select Detailed Errors, the app works remotely. Not leaving this on, so problem is not solved yet, its just more confusing.

UPDATE #2: Using Firebug, I see that the Status is still 401 Unauthorized, but the Response is returning the application's correct HTML.

UPDATE #3 Playing around with Failed Request Tracing, here is the WARNING Request Trace that is causing the 401:

ModuleName ManagedPipelineHandler
Notification 128
HttpStatus 401 
HttpReason Unauthorized 
HttpSubStatus 0 
ErrorCode 0 
ConfigExceptionInfo  
Notification EXECUTE_REQUEST_HANDLER 
ErrorCode The operation completed successfully. (0x0)

Update #4 Regular IIS log is showing this:

#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2010-07-20 19:17:22
#Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status time-taken
2010-07-20 19:17:22 10.10.1.10 GET /Purchasing/Home - 80 - 10.10.1.12 Mozilla/5.0+(Windows;+U;+Windows+NT+6.1;+en-US;+rv:1.9.2.6)+Gecko/20100625+Firefox/3.6.6 401 0 0 4414
share|improve this question
    
Did you tried running Failed Request Tracing on the server and access the application from the remote machine. If there is a failure, you should see the cause. –  Vivek Kumbhar May 13 '10 at 23:45
    
@vivek see my latest update –  mxmissile Jul 20 '10 at 16:53
    
ARRG!!! Got but by this again! 2 hours wasted searching for Html.RenderAction, then realized Razor uses Html.Action so my initial searches came up empty. –  mxmissile Nov 15 '11 at 16:06
    
Oh its been a couple years, guess what? Just wasted 3 hours on this morning on this AGAIN! When will I learn?!?!?! –  mxmissile Dec 7 '13 at 17:39
add comment

5 Answers

up vote 12 down vote accepted

Sometimes you have to take a step back... The cause of this was I had a Html.RenderAction() in my view that called an action method that was marked with the [Authorize] attribute.

share|improve this answer
    
This was my problem, it was a frustrating enough to punch a panda (not that I would). Thanks mxmissile. –  Khalid Abuhakmeh Aug 24 '11 at 13:08
add comment

Since it works locally but not remotely, it sounds to me like the anonymous user account doesn't have access to something, but your windows user does. To prove this, turn off Windows Authentication for the website and see if it breaks locally.

Whatever is breaking is likely running as your website identity instead of your app pool identity, otherwise it would break locally and remotely. My recommendation if you have 1 to 1 mappings of sites to app pools, or you have a highly trusted environment, is to set the anonymous user account to use the app pool identity. Then you don't need to worry about a 2nd user to maintain.

You mentioned process explorer. That's good for finding running info, but the tool that will likely uncover access denied errors is processmon (also from sysinternals). Try it, repro and capture, then search for the word 'denied'. It should turn up any access denied issues on disk.

share|improve this answer
add comment

For some reason this fixed my issue.

Click site in IIS. Double click authentication Right click and pick Advanced settings De-select “Enable Kernal-mode authentication"

share|improve this answer
add comment

You will have this same behavior when you have a filter for custom authorization that inherits from AuthorizeAttribute and one or more calls to OnAuthorization method , with one of them setting AuthorizationContext.Result to `HttpUnauthorizedResult'

share|improve this answer
add comment

Did you check the settings under Authorization rules? If anyone can access this page (which seems to be your goal) make sure that you have an "Allow" rule that has "All Users" under the users column.

Then in "Authentication" make sure there are no conflicts and only Anonymous Authentication is enabled.

Hope that helps.

share|improve this answer
    
Allow - All Users - Inherited –  mxmissile Apr 29 '10 at 20:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.