Windows 2008 R2 IIS7 windows authentication not working

iis-7windows-authenticationwindows-server-2008

I have a dev and prod Windows 2008 R2 servers with IIS7 and siteminder, which as far as I can tell are setup the same. Issue being the production websites work but the development ones do not.

Issue being that when I navigate to any dev website, it says "the page cannot be displayed because an internal server error has occured." I do not get a challenge in dev (which I believe is the cause of the issue), but I do in prod. This goes for classic ASP pages or ASP.NET pages.

Some findings :-
– IIS has Windows authentication enabled and all others disabled
– Windows Authentication Provider is Negotiate (tried Negotiate:Kerberos, same result)
– WindowsAuthentication and WindowsAuthenticationModule (Native) are both present in Modules
– WindowsAuthentication is installed under Server Manager -> IIS -> Roles
– Upon receipt of the above error message, IIS logs shows the access with error 401 2 5

All the solutions I found online either do not have the right setup as I do above, or suggests I disable Windows authentication and enable Anonymous Authentication. If I do so, all works fine but the only issue being my websites require Windows authentication to identify the user. I'm at my wit's end and am just short of reinstalling something in hope it works. Any possibilities or log files that I have overlooked?

Best Answer

After screwing around a bit I finally solved my problem ... hope this helps someone.

  • I realized in fact ASP pages were working but ASP.NET pages were not working
  • When I had turned on Anonymous Authentication, the ASP.NET pages were now giving 500 0 or 500 19 errors in IIS logs, instead of 401 2 5 with Windows Authentication
  • I tried to launch a ASP.NET page from within the localhost and got then 500 error with a more detailed error saying I should use relative path in httpErrors under web.config (??)
  • At this point I realized I had earlier changed the 403 error to a custom file at the default website level, then changed it back. Despite changing it back to it's previous value, What this ended up doing was adding a "remove" then an "add" tag, both for 403.htm, under httpErrors in the wwwroot/web.config. After I deleted the entire httpErrors segment, my websites started working again.
  • Reverting back to Windows Authentication at this point also worked.

So some take aways is to test websites locally first and keep in mind the existing of the wwwroot/web.config giving near untraceable errors ...

Related Topic