RE: HttpContext Problem

Hi Walter,

I think my description of my setup was incomplete. Below is how it looks
like.


TreeView of IIS 6:

Internet Information Services
|
HostName
|
Application Pools
| |
| Pool1
| |
| UploadFileApps
| getEmailAddressApps
| Pool2
| |
| RegistrationApps
|
Web Sites
|
Site1
|
UploadFileApps -> Anonymous authentication (using domain account)
getEmailAddressApps -> Integrated Authention
RegistrationApps -> Integrated Authention


UploadFilesApps and getEmailAddressApps are .Net 1.1 apps. RegistrationApps
is .Net 2.0 app.

When user access UploadFileApps, it will check whether the user's email
address has been captured. If not, it will be redirect to
getEmailAddressApps, get the email address from AD and redirect back to
UploadFileApps. At this moment, if the user upload file(s), there is no
problem. However, if the user click on the link which open up the
RegistrationApps, the upload will fail.

However, I do notice if the link is outside of the same website (in this
case Site1), it is okay.

Thanks,
Alex

"Walter Wang [MSFT]" wrote:

Hi Alex,

The "Authorization: Negotiate" header is used for Kerberos authentication
in IE and IIS, this normally means you've checked "Integrated Windows
authentication" in IIS virtual directory security settings. If you use
Fiddler (http://www.fiddlertool.com/) to trace the http request/response
headers, you will see this. Per the issue here, I'm not sure it's related
since it seems a normal one if you're using Integrated Windows
authentication.

Given that the simple test doesn't reproduce the issue on your side either,
I'm afraid you will have to create the reproducible project on your side.
Here's some suggestion to narrow down from your existing web app:

1) You mentioned that the external web site is on the same server in
another virtual directory, what if we change this external link to other
URL, such as "about:blank", does it have impact on the result?

2) Given that you're using Integrated Windows authentication, what if we
enable Anonymous user? (I've tested it using the same test project with
Integrated Windows authentication but it still doesn't reproduce)

I'm not sure if my test method is similar to your real application or not.
It would be great if we could figure out how to reproduce it using a
simpler app.


Regards,
Walter Wang (wawang@xxxxxxxxxxxxxxxxxxxx, remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.


.

Relevant Pages

  • Re: Windows Authentication problem with IIS6 (Win2k3)
    ... Authentication Protocol is Integrated ... Jeff - Thank you SOOOOO much - your suggestion to check out the IIS ... regardless of the IE setting regarding Enabling Integrated Windows ... >>I believe the problem to be something related to the Kerberos technology, ...
    (microsoft.public.inetserver.iis)
  • Re: Windows Authentication problem with IIS6 (Win2k3)
    ... Authentication Protocol is Integrated ... Jeff - Thank you SOOOOO much - your suggestion to check out the IIS ... regardless of the IE setting regarding Enabling Integrated Windows ... >>I believe the problem to be something related to the Kerberos technology, ...
    (microsoft.public.inetserver.iis.security)
  • Re: Integrated Windows Authentication - 401: Access Denied
    ... try using iis authdiag, make sure all your permissions are squared away. ... > from a browser the Integrated Windows Authentication ... >>> Developing .NET application to acccess web services. ...
    (microsoft.public.inetserver.iis.security)
  • Re: ftp security
    ... can someone tell me if WebDAV with Integrated Windows ... authentication forms a fairly secure pipeline for file transfer? ... and I'm not sure if this affects the way IIS implements security. ... >> I managed a FTP site too, and have the same problem as you. ...
    (microsoft.public.inetserver.iis.security)
  • Re: HELP PLEASE The request failed with HTTP status 401: Access Denied.
    ... Web Security: Part 2: Introducing the Web Application Manager, Client ... Authentication Options, and Process Isolation ... It introduces the Web Application Manager in IIS that ... logon session, which is dangerous. ...
    (microsoft.public.dotnet.framework.aspnet.security)