0

I have a Intranet site that is using Kerberos Authentication. I am having issues when the user is not allowed access

In Firefox the ErrorDocument 401 set in .htaccess works but in IE/EDGE/CHROME you get a browser error (See Below)

Chrome:

This site can’t be reached

The web page at http://mysite/ might be temporarily down or it may have moved permanently to a new web address. ERR_INVALID_RESPONSE

IE/EDGE:

Can’t reach this page

•Make sure the web address http://mysite/ is correct •Search for this site on Bing •Refresh the page

More information More information

The connection to the website was reset.

Error Code: INET_E_DOWNLOAD_FAILURE


.htaccess

    AuthType Kerberos
AuthName "Staff Intranet"
KrbAuthRealms DOMAIN.LOCAL
KrbServiceName HTTP
Krb5Keytab /etc/kerberos.keytab
KrbMethodNegotiate On
KrbSaveCredentials On
KrbMethodK5Passwd On
KrbAuthoritative off
KrbVerifyKDC off
KrbLocalUserMapping On

AuthLDAPURL "ldap://DOMAINCONTROLLER/DC=DOMAIN,DC=local?sAMAccountName"
AuthLDAPBindDN "CN=IntranetSites,OU=Non-staff,OU=Users,DC=DOMAIN,DC=local"
AuthLDAPBindPassword "PASSWORD"
Require ldap-user user1
Require ldap-user user2
ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=/index.php?App=Intranet&Access=Denied\"></html>"

/var/log/apache2/error.log

i get the same error logged no matter what browser i use.

 [Sun Aug 06 23:41:39.848945 2017] [authz_core:error] [pid 6471] [client 192.168.31.250:64258] AH01631: user user3 : authorization failure for "/protectedfolder/": , referer: http://mysite/

I have also turned off Friendly Error Pages in Internet Explorer and still get the same error.

Thanks in Advance for you Help

0

This can sometimes happen if the response / error document you are sending from the server is too small. Anything below a certain number of bytes and the browser will likely display it's own error message. (This is of course assuming that the in-browser setting to display "friendly" error messages has already been disabled.)

In the past, this has been a classic "problem" with Internet Explorer. But other browsers do a similar thing also.

The solution is to simply send a bigger response. In IE it is enough to simply pad the response with a large HTML comment - so it's not actually visible to the user.

  • I have changed the .htaccess so that the ErrorDocument is larger. it is now 623 bytes but i am still getting the same error in IE/Chrome. – Matt_J Aug 7 '17 at 7:58
  • 623 bytes should be sufficient. Presumably, you restarted the browser(s)? (I believe IE does require a browser restart when this option is changed.) Check the HTTP response in the network traffic, is the browser receiving the expected response to begin with? The browser errors you've reported in your question (ERR_INVALID_RESPONSE and INET_E_DOWNLOAD_FAILURE) do not appear to be consistent with a 401 response - so there maybe something else going on here? – MrWhite Aug 7 '17 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.