IIS Madness: 401, Application Pool identities, and IP addresses

Okay, here’s the situation. Set up a new website using Windows authentication only on any port other than 80. Create a “hello world” default.htm.  So far, so good… you may access the site at http://machinename:port. Now set that site to use an application pool with a domain user as the identity. Ensure you run aspnet_regiis -ga MachineName\AccountName. Now you are challenged and receive a 401. 

 

You are now in an interesting scenario:

http://machine:100/default.htm – does not work

http://192.168.1.234:100/default.htm – does work (assumming machine’s IP is 192.168.1.234)

 

Why?

 

According to Microsoft, IIS’s Integrated Windows authentication uses Kerberos v5 authentication and NTLM authentication. If Active Directory is installed on a domain controller running Windows 2000 Server or Windows Server 2003, and the client browser supports the Kerberos v5 authentication protocol, Kerberos v5 authentication is used. To use Kerberos authentication, a service must register its service principal name (SPN) under the account in the Active Directory directory service that the service is running under.  By default, Active Directory registers the network basic input/output system (NetBIOS) computer name.  But what about the computer name under a different port?

 

In summary, the application pool’s identity is not authenticated correctly because of IIS will try to use Kerberos by default.

 

 

To work around this behavior if you have multiple application pools that run under different domain user accounts, you must force IIS to use NTLM as your authentication mechanism if you want to use Integrated Windows authentication only. To do this, follow these steps on the server that is running IIS:

1.	Start a command prompt.
2.	Locate and then change to the directory that contains the Adsutil.vbs file. By default, this directory is C:\Inetpub\Adminscripts.
3.	Type the following command, and then press ENTER: cscript adsutil.vbs set w3svc/NTAuthenticationProviders “NTLM”
4.	To verify that the NtAuthenticationProviders metabase property is set to NTLM, type the following command, and then press ENTER: cscript adsutil.vbs get w3svc/NTAuthenticationProviders The following text should be returned: NTAuthenticationProviders : (STRING) “NTLM”

Reference: http://support.microsoft.com/kb/871179

Advertisement