内部访问时的 IIS Windows 身份验证 401.1
我有一个 Intranet 站点，我们的客户需要从内部和互联网访问该站点。该站点的访问受到 Window 身份验证的限制。
问题是该站点在外部访问时可以正常工作，但在从本地网络内部访问时会失败并显示 401.1。为什么本地认证会失败？
详细信息
- 该站点在 Windows Server 2003 和 IIS 6 上运行
- 该站点禁用了匿名访问，并启用了 Windows 身份验证
- 用户从类似仪表板.example.com 的 URL 访问该站点
- 本地中有一个条目将dashboard.example.com 指向Windows 2003 服务器的DNS
- 我可以将dashboard.example.com 名称解析到Windows 2003 服务器，而不会从本地网络出现问题。
- 客户端活动目录实际上是 example.com 而不是推荐的 example.local 我不确定这是否是问题的根源。
- 新信息：如果从计算机名称而不是 CNAME 访问，站点将在内部运行 http://ServerName
来自互联网
- 用户通过互联网在家中访问dashboard.example.com。
- 系统会提示他们输入用户名和密码
- ，然后进行身份验证并显示站点
这是预期的行为
来自本地网络
- 用户从本地网络访问dashboard.example.com。
- 系统会提示他们输入用户名和密码 尝试
- 三次后会重新出现提示 站点
- 会显示 401.1 身份验证失败消息。
I have an intranet site that our customer needs to access both internally and from the internet. The site has access restricted with Window Authentication.
The problem is that the site works when access externally, but fails with a 401.1 when accessed from within the local network. Why would the authentication fail locally?
DETAILS
- The site is running on Windows Server 2003 and IIS 6
- The site has anonymous access disabled and Windows Authentication enabled
- The users access the site from a url like dashboard.example.com
- There is an entry in the local DNS that points dashboard.example.com to the Windows 2003 server
- I can resolve the dashboard.example.com name to the Windows 2003 server without issue from the local network.
- The clients active directory is actually example.com instead of the recommended example.local I'm not sure if this could be a source of problems or not.
- New Information: The site will work internally if access from the machine name rather than the CNAME http://ServerName
FROM THE INTERNET
- User vists dashboard.example.com from home over the internet.
- They are prompted for their username and password
- They are then authenticated and the site is displayed
This is the expected behavior
FROM THE LOCAL NETWORK
- User vists dashboard.example.com from the local network.
- They are prompted for their username and password
- The prompt reappears for three tries
- The site presents a 401.1 authentication failure message.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我想我已经找到了这个问题的解决方案。事实证明，用户在用户名之前没有正确输入域前缀（即：example\joe）
误导我的第二个问题是直接在 Web 服务器上进行测试。显然，它们是一种环回检查，可防止在服务器本身上正确处理身份验证。有关详细信息，请参阅本文：http:// /msfarmer.blogspot.com/2009/03/4011-errors-with-reporting-services-and.html
I think I have found the solution to this problem. It turned out that the user was not properly entering the domain prefix before their username (ie: example\joe)
The second issue that misled me, was testing directly on the web server. Apparently their is a loopback check that prevents the authentication from processing properly when on the server itself. For more information see this article: http://msfarmer.blogspot.com/2009/03/4011-errors-with-reporting-services-and.html