Hi,

We have a site that is using Windows Authentication on a machine called
server1.domain.com. When accessing this site using IE6 from the server
everything works. This site is also registered in the DNS as
server2.domain.com pointing to the same IP address. nslookup gives us the
correct information.

When we try to access the site using server2.domain.com we are prompted for
username and password and we can't get around it, even if we enter correct
credentials and/or add it to trusted zones.

This is an intranet environment with no proxys. What goes wrong here?

Any help is highly appreciated!

Thanks,
Manso

Re: 401 when authenticating by David

David
Mon Nov 21 18:11:20 CST 2005

http://blogs.msdn.com/david.wang/archive/2005/07/14/HOWTO_Diagnose_IIS_401_Access_Denied.aspx

First, identify the specific type of 401 to narrow down possibilities

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
"Manso" <Manso@discussions.microsoft.com> wrote in message
news:776AB80E-DA79-48CC-A669-CFB11D6F1A65@microsoft.com...
Hi,

We have a site that is using Windows Authentication on a machine called
server1.domain.com. When accessing this site using IE6 from the server
everything works. This site is also registered in the DNS as
server2.domain.com pointing to the same IP address. nslookup gives us the
correct information.

When we try to access the site using server2.domain.com we are prompted for
username and password and we can't get around it, even if we enter correct
credentials and/or add it to trusted zones.

This is an intranet environment with no proxys. What goes wrong here?

Any help is highly appreciated!

Thanks,
Manso



Re: 401 when authenticating by Manso

Manso
Tue Nov 22 00:39:02 CST 2005

Hi David,

Thanks for your reply and link to a good article.

Please see the log, first when requesting server1.domain.com:

#Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port
cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
2005-11-21 15:30:22 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
[browser] 401 2 2148074254
2005-11-21 15:30:22 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
[browser] 401 1 0
2005-11-21 15:30:22 W3SVC87257621 172.16.0.24 GET /Default.htm - 82
DOMAIN\username 172.16.0.24 [browser] 200 0 0

Then when requesting server2.domain.com:

2005-11-21 15:30:33 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
[browser] 401 2 2148074254
2005-11-21 15:30:33 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
[browser] 401 1 0
2005-11-21 15:30:33 W3SVC87257621 172.16.0.24 GET /Default.htm - 82
DOMAIN\username 172.16.0.24 [browser] 200 0 0
2005-11-21 15:30:45 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
[browser] 401 2 2148074254
2005-11-21 15:30:45 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
[browser] 401 1 0
2005-11-21 15:30:45 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
[browser] 401 1 2148074252
2005-11-21 15:30:53 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
[browser] 401 2 2148074254
2005-11-21 15:30:53 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
[browser] 401 1 0
2005-11-21 15:30:53 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
[browser] 401 1 2148074252

As mentioned, there's nothing that differs but the url. The hostname is
pointing to the same IP. It works for all machines BUT when requesting from
the server. I tried to run the AuthDiag tool but it reported nothing. So, it
seems to be related when requesting to server2.domain.com from the same
machine (server1.domain.com).

Any hints on how to troubleshoot issues like this are appreciated.

Thanks,
Manso

"David Wang [Msft]" wrote:

> http://blogs.msdn.com/david.wang/archive/2005/07/14/HOWTO_Diagnose_IIS_401_Access_Denied.aspx
>
> First, identify the specific type of 401 to narrow down possibilities
>
> --
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no rights.
> //
> "Manso" <Manso@discussions.microsoft.com> wrote in message
> news:776AB80E-DA79-48CC-A669-CFB11D6F1A65@microsoft.com...
> Hi,
>
> We have a site that is using Windows Authentication on a machine called
> server1.domain.com. When accessing this site using IE6 from the server
> everything works. This site is also registered in the DNS as
> server2.domain.com pointing to the same IP address. nslookup gives us the
> correct information.
>
> When we try to access the site using server2.domain.com we are prompted for
> username and password and we can't get around it, even if we enter correct
> credentials and/or add it to trusted zones.
>
> This is an intranet environment with no proxys. What goes wrong here?
>
> Any help is highly appreciated!
>
> Thanks,
> Manso
>
>
>

Re: 401 when authenticating by Manso

Manso
Tue Nov 22 14:33:04 CST 2005

Hi again,

I have now tried with wfetch and it works with both server1.domain.com and
server2.domain.com (which is the same machine/ip) so it must be IE/zone
related. We experience exactly the same problem when requesting from an
internal ASP.NET application locally using WebClient, though. I believe the
WebClient in ASP.NET uses the IE/zones settings somehow, though.

Help is very much appreciated!

Thanks,
Manso

"Manso" wrote:

> Hi David,
>
> Thanks for your reply and link to a good article.
>
> Please see the log, first when requesting server1.domain.com:
>
> #Fields: date time s-sitename s-ip cs-method cs-uri-stem cs-uri-query s-port
> cs-username c-ip cs(User-Agent) sc-status sc-substatus sc-win32-status
> 2005-11-21 15:30:22 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
> [browser] 401 2 2148074254
> 2005-11-21 15:30:22 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
> [browser] 401 1 0
> 2005-11-21 15:30:22 W3SVC87257621 172.16.0.24 GET /Default.htm - 82
> DOMAIN\username 172.16.0.24 [browser] 200 0 0
>
> Then when requesting server2.domain.com:
>
> 2005-11-21 15:30:33 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
> [browser] 401 2 2148074254
> 2005-11-21 15:30:33 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
> [browser] 401 1 0
> 2005-11-21 15:30:33 W3SVC87257621 172.16.0.24 GET /Default.htm - 82
> DOMAIN\username 172.16.0.24 [browser] 200 0 0
> 2005-11-21 15:30:45 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
> [browser] 401 2 2148074254
> 2005-11-21 15:30:45 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
> [browser] 401 1 0
> 2005-11-21 15:30:45 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
> [browser] 401 1 2148074252
> 2005-11-21 15:30:53 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
> [browser] 401 2 2148074254
> 2005-11-21 15:30:53 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
> [browser] 401 1 0
> 2005-11-21 15:30:53 W3SVC87257621 172.16.0.24 GET / - 82 - 172.16.0.24
> [browser] 401 1 2148074252
>
> As mentioned, there's nothing that differs but the url. The hostname is
> pointing to the same IP. It works for all machines BUT when requesting from
> the server. I tried to run the AuthDiag tool but it reported nothing. So, it
> seems to be related when requesting to server2.domain.com from the same
> machine (server1.domain.com).
>
> Any hints on how to troubleshoot issues like this are appreciated.
>
> Thanks,
> Manso
>
> "David Wang [Msft]" wrote:
>
> > http://blogs.msdn.com/david.wang/archive/2005/07/14/HOWTO_Diagnose_IIS_401_Access_Denied.aspx
> >
> > First, identify the specific type of 401 to narrow down possibilities
> >
> > --
> > //David
> > IIS
> > http://blogs.msdn.com/David.Wang
> > This posting is provided "AS IS" with no warranties, and confers no rights.
> > //
> > "Manso" <Manso@discussions.microsoft.com> wrote in message
> > news:776AB80E-DA79-48CC-A669-CFB11D6F1A65@microsoft.com...
> > Hi,
> >
> > We have a site that is using Windows Authentication on a machine called
> > server1.domain.com. When accessing this site using IE6 from the server
> > everything works. This site is also registered in the DNS as
> > server2.domain.com pointing to the same IP address. nslookup gives us the
> > correct information.
> >
> > When we try to access the site using server2.domain.com we are prompted for
> > username and password and we can't get around it, even if we enter correct
> > credentials and/or add it to trusted zones.
> >
> > This is an intranet environment with no proxys. What goes wrong here?
> >
> > Any help is highly appreciated!
> >
> > Thanks,
> > Manso
> >
> >
> >

Re: 401 when authenticating by Manso

Manso
Tue Nov 22 15:05:14 CST 2005

So, to clarify.

I have one server called server1.domain.com. It's also registered in the dns
as server2.domain.com.

When navigating to the site on the machine I can connect when going to
server1.domain.com but not when going to server2.domain.com. This only
happens when we use IE on the server, not from workstations. It's Windows
2003 SP1. *.domain.com is added to trusted sites. It works with wfetch so
it's IE related.

When connecting to server2.domain.com we can't get pass the login dialog. A
strange thing I have noticed is that it says "Connect to server1.domain.com"
in the window caption and "Connecting to server2.domain.com" in label above
the username. Does IE get confused with the authentication roundtrips
somehow? Can we somehow ease up on Enhanced Security Configuration? We really
need to use this on this server. ASP.NET applications are having the same
problem which is the main problem.

Thanks,
- Manso

"David Wang [Msft]" wrote:

> http://blogs.msdn.com/david.wang/archive/2005/07/14/HOWTO_Diagnose_IIS_401_Access_Denied.aspx
>
> First, identify the specific type of 401 to narrow down possibilities
>
> --
> //David
> IIS
> http://blogs.msdn.com/David.Wang
> This posting is provided "AS IS" with no warranties, and confers no rights.
> //
> "Manso" <Manso@discussions.microsoft.com> wrote in message
> news:776AB80E-DA79-48CC-A669-CFB11D6F1A65@microsoft.com...
> Hi,
>
> We have a site that is using Windows Authentication on a machine called
> server1.domain.com. When accessing this site using IE6 from the server
> everything works. This site is also registered in the DNS as
> server2.domain.com pointing to the same IP address. nslookup gives us the
> correct information.
>
> When we try to access the site using server2.domain.com we are prompted for
> username and password and we can't get around it, even if we enter correct
> credentials and/or add it to trusted zones.
>
> This is an intranet environment with no proxys. What goes wrong here?
>
> Any help is highly appreciated!
>
> Thanks,
> Manso
>
>
>