double authentication issue on IIS / Report Server (SQL server 2008) - iis

On a 2003 server box, with SQL server 2008 installed (ReportServer deployed in IIS mode), I've got a virtual directory within IIS with it's security set to 'windows authentication', with the following html code:
<body>
<h1>test</h1>
<iframe src="/reportserver" witdh="50%" height="50%" />
</body>
From the outside, I've got a first login/pwd box displayed to access the html code, then a second one to display the content of the iframe.
On the same type of server, but with SQL Server 2005, I don't have this issue (i.e. only one login box).
My thought is that the first token should give acces to both the page and the iframe, isn't it?
Any hints on how to setup the reportserver to fix this?
thanks.

I recently had a similar issue. Turned out that Reporting Services for 2008 was installing with SSL enabled by default and I was getting forced redirections to https://localhost/ReportServer. Just mentioning it because it caught me by surprise...
I disabled SSL redirects by setting the SecureConnectionLevel = 0 in the RSReportServer.config file.

Related

Classic ASP on IIS 8.5 (Windows Server 2012) - Bad_file_name_or_number

I have a classic ASP web application I have installed on IIS 8.5 - Windows Server 2012. The ASP application uses VBscript for all server side logic.
After setting up the application on IIS, making sure to install the ASP/ISAPI filters/components through the server manager and also making sure to set the "Anonymous" and "Windows based" authentication to enabled, I am getting the following 500 error on my client web browser when I navigate to the root page of classic ASP application:
2016-08-26 18:48:54 10.121.71.194 GET /vhtrimswebquery/ |24|800a0034
|Bad_file_name_or_number 443 - 10.38.151.105 Mozilla/4.0+(compatible
;+MSIE+7.0;+Windows+NT+6.1;+WOW64;+Trident/7.0;+SLCC2;+.NET+CLR+2.0.50727;
+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+Media+Center+PC+6.0;+InfoPath.3;
+.NET4.0C;+.NET4.0E;+GM_UserLogonTimeBias:+300;+GM_UserLogonTimeUTC:
+2010-12-13+15:06:21) - 500 0 0 124
I don't know what I am missing. The "Default document" section in the IIS settings for the application has a default page setup which exists. If anyone has worked with this error before, can you point me in the direction as to what I can look at or update in the configuration to get the default page?

IIS returns error code 403 in response header and no error page

My setup:
Windows Server 2012
IIS 8.5
SharePoint 2013
The SharePoint site is configured to requeire client certificate. If the user has no valid certificate or the password was wrong IIS returns error code 403 in response header. I would like IIS to return a custom error page instead where I could guide the user how to fix the issue.
There are just to many options where I can configure error pages. Which is the right one?
In IIS I have three possible sites to configure.
Default Web Site
My web application
My web aplication port 443
Custom errors in web.config
Error Pages in IIS
.Net Error Pages in IIS
I have tried some of these options but with no success. Can anybody help me?
Just edit the web.config file in your Visual Studio solution, modify the customErrors section and then check the file into Github to trigger a new deployment.
If you don't use VS, then find your web.config file. Worst case scenario you can edit it directly.

How to pass windows authentication credentials to different site on the same server

I have an asp.net mvc web application on IIS server(MySERVER). On one of the pages I use a IFrame element to display another resource(QlikView Dashboard) which is also servered up from the same IIS server(MySERVER). The IFrame element that I use on the first site is as follows.
<div id="reportFrameDev">
<iframe id="reportFrame" src="http://MySERVER/QvAJAXZfc/opendoc.htm?document=Ashwini/CMS.qvw&host=QVS#bh-vmapp01" frameborder="0" height="800" , width="100%"> </iframe>
</div>
The first site has Forms Auth. But this second site (MySERVER/QvAJAXZfc/) is configured for windows authentication (which I dont want to change) and this bothers users with a windows authentication pop-up windows. I want to avoid this pop-up without altering the windows Authentication mechanism(on the second site). So I am exploring different ways to pass on windows credentials from my first site to send one(both on the same server - MySERVER) securly. The best I guess would be on the server side code itself. If not what are the ways using cookies, What about local storage? From the browser can this be done Securely?

Is it true that ASP.NET MVC Browser link does not work for https (SSL) url?

I am trying the Browserlink feature of ASP.NET MVC 5 and everything works great for non SSL pages. But if I navigate to a SSL page (with https url), I see 0 connections in the Browser link dashboard. So, is it true that Browser link works only for non SSL urls ? Or am I am missing any settings which will allow me to get Browser Link connection for both SSL and Non SSL urls ?
(I am testing from IIS)
According to this link, Microsoft is working on it.
I have been able to get around the issue by following these steps (using Chrome):
When the debugger opens the browser, open the F12 tools.
Go to the Console tab.
There should be an error message that looks something like this: GET https://localhost:[port]/[guid]/browserLink net::ERR_INSECURE_RESPONSE
Open the link in a new tab.
Click Proceed anyway.
Close the Browser Link tab.
Reload the tab with your app.
Browser Link should then start working.
I've also worked around it by getting the script link, reducing it to the root, and browsing there. Once there, accept the cert warning then view the cert and install it into the trusted roots. From then on, the cert will be trusted and the script will load automatically.
It appears that this limitation has been removed in Visual Studio 2015. I do not see any mention of this in the release notes, but Browser Link is fully operational in my dev environment under SSL.
I was unable to get Browser Link, Web Essentials, to work with SSL, even with the mentioned remedies. I was able to find a way, however, to get it work for me.
I am running my app through IIS (not express) and my app was nested under the default website. When debugging the site I saw that Chrome was dumping a connection error with a URL using port 44399. Adding a binding for this port, for https, then allowed the connection to be successful. I also used a local development cert for the SSL Certificate.
DISCLAIMER: Visual Studio tries to be your buddy and not use ports that you've bound to in IIS so once you close and re-open Visual Studio it will likely not use the 44399 port anymore. It looks like it decrements until it finds the next available port. So assuming you're not using 44398 this will be your number. Once you unbind 44399, then close and re-open Visual Studio it will likely rebind to 44399 again.
Hopefully this helps some of you out.
I had a similar issue involving custom domains and subdomains on IIS Express over HTTPS.
(Using SSL certificate I self-signed with support for localhost and my custom domain, installed with self-signed root authority in the trusted certificate store)
I had got IISEx to use the certificate and serve it on port 443 (as admin user), but browserlink was failing with CONNECTION_RESET.
This persisted even after switching back to using localhost as the website url for IIS etc.
Turns out I had forgotten to replace the certificate associated with the other ports IIS Express uses (specifically port 44399), which were still associated with the default development certificate used by IIS Express
http://www.iis.net/learn/extensions/using-iis-express/handling-url-binding-failures-in-iis-express
http://benjii.me/2014/11/run-iis-express-on-port-443-using-ssl-and-wildcard-subdomains/
[Simple Guide but missing the delete existing certificate bindings guidance]
For Windows 10 IIS Express users.
In visual studio click "View in Browser" in Browser Link
Dashboard .
An IIS Express icon will appear in system tray.
Right Click the IIS Express icon.Your application should be listed in both HTTP and HTTPS.
Hope it helps.

iFrame display content from another server

I had created a simple portal site for our internal users, just a CSS menu with our internal web services which then displayed in an iFrame. Worked well so far.
Our helpdesk software was GLPI running on APACHE on the same server and had no issues. We recently upgraded to the latest version and in the meantime I moved it to our new web apps server and switched to IIS. The 'portal' is still hosted on the old server.
When I updated the javascript for the iFrame to point to the new address, it looked like it worked, I could get the login screen for GLPI. After logging in however I just get stuck at a white screen. If I try it in IE I get the message:
This content cannot be displayed in a frame
To help protect the security of information you enter into this website, the publisher of this content does not allow it to be
displayed in a frame.
What you can try:
Open this content in a new window
It doesn't seem to be the iFrame itself as I can get the login page.
My question is, can anyone give me some ideas on where to look at this issue? I've checked the IIS logs on both sides and see no errors, GLPI reports no errors, neither does PHP.
GLPI is on IIS 8 on Server 2012
The 'portal' is on IIS 6 on server 2003
GLPI running on PHP 5.3.0
EDIT: I've looked into the X-FRAME issue and I'm pretty sure this is not it, servers are on the same domain and I am able to get to the login screen of the second server through the iFrame, just no content after that. If it was an issue with the frame or permissions I would expect to not get to the site at all?
The only header response currently in IIS is 'X-Powered-By --> ASP.NET' am I looking in the wrong spot?
The server is returning an X-Frame-Options header used to prevent ClickJacking. That header must be removed (or updated with an Allow-From directive that lists the framing page's origin) in order for the target page to be rendered as a subframe.

Resources