SSO with ADFS 401 issues - iis

We recently migrated a couple of our MVC apps to SSO using ADFS with basically the following approach: https://www.cloudriven.fi/en/cloud-9-en/how-to-implement-sso-for-asp-net-mvc-application-with-adfs/ I've noticed sometimes when the browser attempts to access a static file, I get a 401 error and the app reverts to NTLM negotiation. This is okay on our network as the users are logged in and it only seems to happen with a handful of files, however for remote access, this seems to happen for all files and users have to enter their credentials, sometimes several times. We have another application on another server configured the exact same way with no problems. Has anyone come across this behavior?
Edit: Here is the trace:
https://1drv.ms/u/s!AquuuuC3yZ55hkLix_TCaVVblSL8
And the xsl file if anyone needs it:
https://1drv.ms/u/s!AquuuuC3yZ55hkNbh3qHdRijQXGy
Edit 2: I have this same configuration running on IIS6 with no problems. This problem is only occurring on IIS7.

Related

Apache Webserver - getting security risk error on local network but not on public domain

I have an asp.net core MVC website running with an asp.net core Rest API on the same server. It was a bit tricky to set up the Apache2 configuration, but I finally got it working.
From the outside, everything works perfectly. I can access https://{domain}.com and it works, and I can access https://{domain}.com/api and it works too. I was getting a weird error, the MVC project couldn't find the api project even though I could find it from the outside.
In the same network, I have a linux machine with a GUI so I can browse to the internet from there. I discovered that https://{domain}.com gives a security error, and that is probably why the two projects can't communicate with each other.
In above screenshot ou can see what I get when going to that website. It works fine from a different network.
The server is configured with SSL using LetsEncrypt. The SSL is fine from outside, but apparently not from inside.
Here you can see my apache2 configuration.
My goal is that I can access https://{domain}.com from the internal network, I think that will solve my issue.

NTLM on IIS 8.5 on Server 2012, second web site failing

Maybe you'll be able to help me out.
My situation is this:
We are migrating to from Win2003 to Win2012. We've got multiple web sites configured on the 2003 box and we can browse to each of the different names no problem at all, using Windows Integrated.
Well, we just fired up a Windows 2012 and started migrating to it but running into an ntlm 401 issue (log says specifically 401.2.5).
Changing the names to protect the innocent here:
Server Name: Server
going to http://server/apps/asmx/servivce.asmx works fine.
We have a second IP assigned to a new the same box, on port 80, but configured so we can go to http://conapps/apps/asmx/service.asmx. That should work, and return a simple wsdl, but it doesn't.
if we go to http://conapps/apps/anonymous/asmx/service.asmx, it works fine.
I've gone into the authentication tab, and have windows Integrated (and NTLM bubbled up to the top) but I keep getting the 401 errors. Ironcially, if I set anonymous on, it works as expected.
As I said, if I take the default web site, and configure it to point to the same physical files on the disk, it works fine. It's only when I try to go to the secondary name do I have problems.
So, anybody have any ideas what I might be missing?

IIS Shared config - applicationHost.config Error: Cannot write configuration file due to insufficient permissions

I've setup a UNC share for IIS shared config using a specific AD service account and set to FULL CONTROL. I've also exported the config from one IIS server and set-up an additional IIS server to point to the share. When I open the applicationhost.config for example on the UNC share and remove an application pool, I can see the entry also remove in both IIS servers.
So I know:
1) I can export to the share with the specific service account
2) Both IIS servers can read the config when I edit manually
3) However when I remove an app pool from one of the IIS servers through the manager I get the above error.
I've tried using the process monitor utility to see what account is being used to write to the config and it seems it is my own AD user account rather than the shared service account. I know IIS Manager has my username e.g. ROOT\MYNAME logged on, but I wouldn't have thought it would use this to write changes to the shared config. Surely it would use the service account?
Does anyone know how to prevent this error? Why does the shared config and tied service account not come into play when making changes on one of the servers?
So, IMHO, this error is a red herring. I was publishing to a server and got a message saying I was out of space. So, I logged in, realized there was a bit of cruft in extra apps published in IIS, we didn't need. I right clicked and tried to remove one. I got the same error as you.
Having done some manual changes to applicationHost, I thought it "might be me" but it seemed very odd that editing this file would cause such a thing. However, I had recently learned that windows does some funky 32 vs 64bit machinations with this file (google it).
Deciding I had better things to do, I asked our IT to add space to the VM and guess what? I am no able to remove these apps. My guess is that I was at the end of the line on space and the backend management of these special files was not completing and throwing this not-so-helpful exception.
I'm not a 100% about this. For full disclosure, I will add that updates had been applied recently, but I'm pretty confident that this is a possible solution.

Windows Azure MVC3 app - 500 - Internal server error

I was running my application with no errors locally, but when added Windows Azure project, set up the database config, generated the packages and ran in stage mode, I just can get 500 internal errors.
My app has some redirections for logged and non logged users.
I tried to follow some answers about the problem with no results. When I run the application locally with the emulator everything runs ok.
I didn't set any permission or user anywhere in my SQL or Windows Azure panel. As I don't have any experience with Windows Azure, please explain steps on how to do things =)
Now, after reading almost 20 articles, I realized that I was using the old Membership and Session Providers, and that the old aspnet_regsql doesn't fit Windows Azure.
So, the first action of my application was watch if the user was logged in. Because of that, the 500 Internal errors.
Articles that helped me a lot:
http://geekswithblogs.net/ranganh/archive/2011/06/21/using-the-asp.net-membership-api-wish-sql-server--sql.aspx
http://www.hanselman.com/blog/IntroducingSystemWebProvidersASPNETUniversalProvidersForSessionMembershipRolesAndUserProfileOnSQLCompactAndSQLAzure.aspx

Most Strange IIS Windows Authentication behavior

I have an ASP.NET website running on Windows Server R2 in a corporate network, using Windows Authentication.
The app pool of the website is using a domain account and in Integrated pipeline mode.
The authentication is set Windows Authentication, all other authentication modes are disabled.
However, this does not work. Every time I access the website, it pops up a dialog asking for user name and password. I enter the correctly domain user name and password, but it does not continue--the windows pops up again. After three times, it fails and displays a white page. I tried with many different browsers, bu all of them fail. I asked some colleagues to try and they all got failure, too.
I cannot figure out why this error is happening and tried many ways to fix it with no luck. I think it is very strange. However, finally I found a way to fix this problem, this is the most strange part of the problem: I edit the "Physical path" in "Basic Settings" of the website, I just point it to another healthy website, for instance, %SystemDrive%\inetpub\wwwroot, then I try to browse the website, very good, it runs well and displays the default page (iisstart.htm). It looks like it is not very helpful, but then I change the physical path back to my website; suddenly everything goes well -- the windows authentication works! I do not know why it helps, but I am happy with this result -- it fixes my problem though I do not know what the heck is happening.
The happy time is always short, several days later, the server got some patches and restarted, the website can't work again. And again, I can fix the problem using the trick above.
I do not like this! I do not like doing this stupid trick every time IIS resets or the server restarts.
Is there anyone who has some ideas on why windows authentication fails, and why the aforementioned trick can fix it, and why after an IIS reset it fails again?
First off, THANK YOU for creating this post. I have the exact same issue and could not find anyone else without posting the obvious fixes that were of no avail to me. I had been working on this for almost two weeks
To assist the next poor soul that encounters this issue and post, I hope my extra tidbits help.
Your initial solution did not fix my issue in my case, but it did prove that it was custom error page related. After pasting in your code into web.config my problem got worse and I was not able to debug or launch the page (had 500 internal server error related to web.config)
BUT finally what I did was go into the IIS Console and remove all of my custom error pages. It still did not work as had hoped. BUT, I also found entries for ASP.NET ".NET Custom Errors" in the top half of the site console (and the "custom errors" tag in web.config). I had old entries in there and removed them via console, and YESSSS, my site came back to normal with Windows Authentication.
I have since recreated the IIS Custom Errors and I am still up and running as designed.
SO to anyone else that may have this issue, check both ASP.NET Custom Errors AND IIS Custom Errors settings. Maybe there is a conflict, I dont know, but in my case having only the IIS pages set fixed me up (for now :-) )
I just found it seems caused by custome 401 error pages under "Error Pages". I set it to execute an URL when the status code is 401 in my web.config, it looks like:
<httpErrors errorMode="Custom">
<remove statusCode="401" subStatusCode="-1"/>
<error statusCode="401" path="/Error/AccessDenied" responseMode="ExecuteURL"/>
</httpErrors>
Then every time I reset IIS and try to access this website, the problem appears. If I delete it in Web.Config or delete from IIS console, then the problem disappears, what is more funny is another experiment: after I deleted this settings and have been successful opening the website, I added this setting back. Everything works very well. Every domain user can access this website, those that failed passing authorization get the customer error page.
So my solution now is I removed this setting in my Web.Config, every time I reset IIS or restart the server, the server admin need to hit the website first, and then add this customer error page in IIS console.
I feel this is a bug of II7.5 on Windows Server 2008 R2.
I was also struggling with this same issue all my day. I am using windows authentication and Custom error setting in web.config for 401 errors.
After I reset the IIS, the website stop accepting domain users and windows authentication pop up reappear again and again.
I added remove tag in the web.config file with Sub status code.
<httpErrors>
<remove statusCode="401" subStatusCode="-1" />
<remove statusCode="401" subStatusCode="1" />
<error statusCode="401" subStatusCode="-1" path="/Custom401.aspx" responseMode="ExecuteURL" />
<error statusCode="401" subStatusCode="1" path="/Custom401_1.aspx" responseMode="ExecuteURL" />
</httpErrors>
Previously remove tag was only present for substatus code -1 but missing for sub status code "1" . After i added it, everything started woking properly.
In the above post, substatus code is missing for error tag, that could be the cause of the problem. There should be remove tag for all 401 errors there.
I just spent a couple of hours digging up a solution to this problem.
Why IE fails yet the other browsers succeed: IE tries to use Kerberos authentication and the other browsers don't try. The others use NTLM.
Solution: In the situation described in the question, a domain account was being used in the App Pool. Simple solution: switch to using the "Network Service" account. More complex solution: You have to register a service principal name (SPN). Read this article (ignore the fact that it is talking about IIS 6 because it also works fine on IIS 7 and 7.5) - You receive an "HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials" error message when you try to access a Web site.
I hope this helps. It gave me a headache until I stumbled upon that article. (Thanks to Paul Lynch who posted the link Windows Authentication Failing in IE8 but not Firefox)
I had this same problem on my Windows 2008 R2 server. I did not have custom 401 error pages. I did use aliased server names (via DNS CNAME records and host header entries on the IIS bindings). I registered the SPNs for Kerberos as suggested, but that did not solve the problem. I resolved it by disabling "Kernel Mode Authentication" (click on the server in the IIS tree -> double-click on Authentication under the IIS group -> click on Windows Authentication -> click on Advanced Settings on the Actions pane -> Uncheck the checkbox -> click OK -> run iisreset). The information on that dialog box recommends against disabling Kernel Mode Authentication when using non-standard service accounts for the application pool identity, but that didn't apply to us since we're using the standard ApplicationPoolIdentity identity.
I had the same issue.. Turnes out I should not have messed with my hostfile.. I changed my hostfile and pointed some fancy address to my machine like so:
www.givemeyourcredentials.com 127.0.0.1
I added a binding to the site "www.givemeyourcredentials.com". I typed in the addres in my addressbar and the site prompted my credentials as expected.. Typed in my credentials and got prompted for my credentials again.. And again and again and again..
Turns out: Bind your website to http://localhost when using windows authentication in an IIS site. That did the trick for me.
Hope this helps somebody...
Add "NT Service\trustedInstaller" to physical folder of the site. Location for this user is local machine name.
The NTLM protocol that is used for Integrated Windows authentication requires a two-step process to authenticate clients. The behavior that is mentioned in the "Symptoms" section occurs when the following conditions are true:
The application pool recycles after the first step of the Integrated Windows authentication process.
However, the application pool recycles before the second step of the Integrated Windows authentication process.
To work around this behavior and to reduce the frequency of these error messages, configure the application pool to recycle less frequently. To configure application pool recycling, follow these steps:
Click Start, click Run, type inetmgr, and then click OK.
Expand the name of the computer on which you want to configure application pool recycling, and then expand Application Pools.
Right-click the application pool that you want to configure, and then click Properties.
On the Recycle tab, configure one of the metrics so that IIS recycles less frequently.
Note IIS 6 application pools support several metrics. These metrics include the time elapsed, the number of requests, and the specified time to recycle an application pool. If an application pool has a metric that causes the application pool to recycle frequently, you will experience this issue more frequently.
Click OK.
[ Copied from https://support.microsoft.com/en-us/kb/902160 for posterity ]

Resources