Windows Forum

Ask something
Discussion Locked

NT Challenge response

0 helpful
5 replies

by stergios_nik

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello,

I have an Internet Information Server 4.0 that operates with Basic Clear authentication.

There is a part of the Web site that requires password in order to access the information.

The problem is that if I enable NTLM Challenge response on the Web Server the client (from outside facility) reports that he sees the following message.

"HTTP Error 401
401.3 Unauthorized: Unauthorized due to ACL on resource
This error indicates that the credentials passed by the client do nothave
access to the particular resource on the server. This resource could be
either the page or file listed in the address line of the client, or it
could be another file on the server that is needed to process the file
listed on the address line of the client.
Please make a note of the entire address you were trying to access and then
contact the Web server's administrator to verify that you have permission to
access the requested resource."

If I enable basic clear text (disable challenge response) it works without problems and the user can access the restricted information.

What cause this problem?
Thanks in advance.

5 replies

by aaron h.

There are several problems that can be occurring. One of the most common is that if your clients are attempting to access your NTLM protected sites with Netscape, they will fail. Netscape cannot process the NTLM password exchange. All browsers support Basic Authentication. But that is, as you stated, in the clear. (NOTE: While this problem may not have been Microsoft?s doing, the problem with Digest Authentication and Netscape on IIS 5 is due to Microsoft proprietary extensions.) Another problem could be that you are clients are not passing in the correct Domain Name for the account they are logging in with. Is your web server a member of a domain? If so, is the account users are logging in with a domain account? Or, is it a local account on the web server itself?

Finally, enable auditing of File and Object Access Failure on the web content in question and see what account name and domain is showing up in the event logs as failing to access the content.

by gperrie

Another problem can be if the user authenticates, IIS will always use these credentials from now on. If they then try to access a resource with the ACL set to Anonymous only then the authentication fails giving this error message.

Gavin

This discussion is closed to new replies.