Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have created an asp.net website that is to be accessed from client browsers running on the same domain.

I've hosted the site on IIS 7.5

I have disabled Anonymous Authentication and Enabled Windows Authentication from the Features View under the IIS section.

I have added the following in the web.config for the site:

<authorization>
  <allow users="group\BizTalk Application Users" />
  <deny users="?" />
</authorization>

I am able to open the website from a browser when running on the server that is hosting the site. However, if I then logon to a different server in the same domain, using the same credentials, when I try to browse to the site I get an http 403 error.

After getting no joy with the above I tried disabling all security to the site. I disabled Windows Authentication and enabled anonymous authentication but still I get the same error. I checked the IIS log on the server and can see that the sub code for the 403 is 18.

I've run fiddler on the client and see the following request / response:

Request

GET http://tst-bts01/Vasanta.Int.SEOPSupportApp/Orders.aspx HTTP/1.1
Accept: image/jpeg, image/gif, image/pjpeg, application/x-ms-application,       application/xaml+xml, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-  powerpoint, application/msword, */*
Accept-Language: en-GB
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0;   SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
Host: tst-bts01

Response

HTTP/1.1 403 Forbidden
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Tue, 29 Jan 2013 10:24:34 GMT
Content-Length: 0

I've tried changing the app pool that hosts the site. I've tried disabling the call the corporate proxy (isa server), running out of ideas now.

Can anyone tell me what I've done wrong?

Thanks, Rob.

share|improve this question

2 Answers 2

You need to read the webserver logs; by default, these are stored in %SYSTEMDIR%\LogFiles\.

The line corresponding to the above request includes a substatus error code in addition to the 403 status; those codes are explained in detail on the Microsoft support website.

share|improve this answer
up vote 0 down vote accepted

The error was a 403.18. Seems that this was caused by the fact that I'd setup custom error messages for authorization failures.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.