Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a problem with an ASP.NET application that was running on IIS 6/Windows 2003, and has recently been deployed to a new server, also running IIS 6 and Windows 2003.

It is using Integrated Windows Authentication, which works (or defaults back to Basic) in the following situations:

  • Offsite/outside the network, using the fully qualified domain name, e.g. www.school.com/intranet/
  • Onsite/in the network, using the server's name, e.g. web-machine/intranet/

However, using www.school.com/intranet/ when inside the network, whether on a domain-connected computer or not, the authentication immediately fails, with:

Error message 401.2.: Unauthorized: Logon failed due to server configuration. Verify that you have permission to view this directory or page based on the credentials you supplied and the authentication methods enabled on the Web server. Contact the Web server's administrator for additional assistance.

It does not default back to Basic authentication, and there are no messages in the Event Viewer on the server.

In IIS 6, the Directory Security for the Virtual Directory is set to allow anonymous access (some pages do not require authentication), and integrated windows authentication.

Because the server it was on died, I don't have access to its configuration, so I can't tell what I'm missing. It used to run under ASP.NET version 1.1.4322 but now runs under 2.0.50727, but I don't believe that should matter.

As everything works, but depends solely on the URL used, I'm not sure what the problem is.

share|improve this question
add comment

2 Answers

Not really an answer but does the FQDN (www.school.com) is getting to the correct IP address, correct? I'd adjust local policy on the server to turn on some of the audit logging options to see if that offers any hints...

share|improve this answer
    
Yes it is, because the pages that don't require authentication work fine, and if I screw with the configuration, it screws with what I see. Could you point me in the direction of the audit logging options that would be most useful? I'm not very familiar with Windows Server environments. –  Tim Jan 31 '11 at 7:31
    
Local Policy >> Audit Policy >> Audit Logon Events: Failure and Audit Account Logon Events:Failure should give you the best results. –  SBWorks Feb 15 '11 at 5:49
add comment

By default, integrated windows authentication is only used for the "local intranet" zone in Internet Explorer. Thus, if www.school.com isn't recognized by IE as being a part of the local intranet, integrated authentication won't work.

share|improve this answer
    
But it should default back to Basic authentication in this case, right? I think I now know at least one reason why it isn't working, as access through the FQDN was going out through a proxy and then coming back in again. But again, I would have thought/hoped it would then default back to Basic, rather than just fail. Will update once had a chance to try again. Delayed more so now by a particularly crippling earthquake last week. Thanks for your help. –  Tim Mar 3 '11 at 8:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.