SSO only works for admins

[Sale_El]

Hello,

 

I am trying to get SSO working this half term, i have got it working lovely on my admin users but any student or teacher users are prompted for a login, when they type their credentials in it tells them its wrong, if i put my credentials into their logon box it logs in as me. Is tehre anything i need to add to IIS or something to allow specific groups o be able to use SSO?

 

Thanks

[Sale_El]

If i make a user a member of domain admins it works fine so must be a permission problem of some sort.

[Steve21]

SSO as in remotely using AD credentials? Have you setup the AD settings in the admin section?

 

Also you mention prompted for login, is that the normal HAP login page, or are you trying to use Windows Authentication and getting that popup?

 

Steve

[Steve21]

If i make a user a member of domain admins it works fine so must be a permission problem of some sort.

 

Mainly in regards the the Nested Lookup/Recursion etc depending how far down the users are

 

Steve

[Sale_El]

Hey Steve thanks for the reply.

 

SSO as in windows credentials passed on to HAP so the webpage auto loads with the users correct tiles. AD is set up in the admin section. Prompting for login is not normal if SSO is working correctly unless you are external then it should prompt a forms login.

 

Yes using Windows authentication cheers

 

Users are not that far down really, even if i bring them right up in their own test OU it still doesn't work unless they are a member of domain admins.

[Sale_El]

If i give a test users modify access to the HAP directory it works, Does anyone know what it would be referencing for SSO to work? i have tried

 

Kerberos.aspx

Logon.aspx

 

but singly these do not work.

[Steve21]

If you mean within the school etc locally, have you checked to make sure the site is classified as an intranet site in your IE settings? Else it wouldn't be trusted to pass credentials to etc.

 

Thing is though that shouldn't stop you typing it in manually. When you're typing it in for a user are you putting your domain name first? e.g. Domain\Teacher to test the login? Just wondering if it's IE settings that makes it thinks it's external then it wouldn't put the domain name into the username it's passing on

 

Steve

[Sale_El]

I have made a GPO with all the correct settings applied for IE and they appear to be pulling through fine according to gpresult.

 

if i type it in manually it already recognises the domain, after the first fail it puts domain\username and password stored but it still doesn't log in unless they have permission to something in the hap area.

[Sale_El]

after digging around on this it seems that the users need to read a file in the hap directory somewhere.

 

If I grant a test user read only access to the hap root folder these users can log in fine. There must be something in the HAP site that the users need to be able to get to in order to authenticate.

[nickbro]

Hmm, there must be a slight setup problem with your HAP+ install there, it looks like it's impersonating the user in the request to kerberos.aspx as you shouldn't need to add any additional permissions.

 

Can you check applicationHost.config in the inetsrv folder that this exists

 

[Sale_El]

Hey Nick, thanks for the reply, when i copy and paste your script i cant get in at all. just says 401 invalid credentials.

[Sale_El]

the only thing that seems to work is not having the kerberos.aspx in at all and just having this

 

 

don't know why it falls over when trying to access the kerberos stuff?

[Sale_El]

So i have done some external testing and the my files tile doesnt work with my configuration.

 

I have changed it back to how you said it should be nick and i noticed some errors in the event viewer that might help identify issue.

 

"the worker pricess for application pool "HAP' encountered an error 'Configuration file is not well-formed XML'

trying to read configuration data from file '\\?\c:zinetpub\temp\apppools\HAP\HAP.config

Line number '3'. the data field contains the error code.

 

Does that mean anything?

[Sale_El]

hmm think thats because i changed the applicationhost because its not moaning anymore.

 

its really strange whats happening.

 

Its almost like its hitting the site then trying to log in anonymously which fails but then its not reading the kerberos.aspx IIS thing which tells it to use the windows login information.

 

can anyone point me in the right direction with this?

 

could it be to do with my https redirection?

[nickbro]

Hmm, have you defined the IP address ranges for internal addresses so the SSO can work correctly, it kinda sounds like that is missing and it's trying to log everyone in with Kerberos/NTLM.

 

You can try out turning off SSO in HAP and revert to the login page.

 

My Files will not work when a user logins in via SSO, as such neither will the tile. Unless you are using Windows Authentication over Forms.

 

 

From the looks of your config you are using Windows Authentication for the whole site rather than forms, have you set the authentication method in the hapConfig.xml file to Windows (instead of Forms)?

[Sale_El]

Hey Nick,

 

internal addresses are defined correctly i believe with this in the hapconfig.xml

 

 

I have changed the way it works now and SSO is working for IE and forms is working for users externally, here is my config;

 

 

This appears to be working as expected, the only problem i had is this morning i was getting 500 internal server error, i had to roll back the changes and reapply them and the error went away, any idea why it would give me a 500 error?

 

finally, i dont see anywhere in my hapconfig.xml it being set to forms or windows i must be missing a line of code somewhere?

 

cheers.

[nickbro]

It's an advanced feature to enable Windows Authentication HAP+ wide, it is in the documentation, but the default setup is for Forms Authentication and SSO Kerberos internally.

[Sale_El]

Hey nick do you have a link to the documentation link to hand? I've followed youtube vids and pdfs and I'd love to know exactly which one you mean.

 

Thanks

[nickbro]

You don't need to enable Windows Authentication unless you don't want Forms authentication at all, it's mainly meant to be used when behind a reverse proxy which does that sort of thing, in that situation you remove the internal IP addresses, and set in the web.config file over to Windows authentication mode, and add to the AD element mode="Windows"

[Sale_El]

Hey Nick, Thanks for the reply, after reading your messages again I have concluded that i am trying to do what you originally said. I am trying to have SSO working with kerberos internally and externally be prompted with a forms login box. Now with the above IIS applicationhost settings, it does exactly this. However, randomly the site gets a 500 internal server error. After checking the logs i see the event below consistently throughout the day, so I don't think that is causing the issue but i thought i would mention it anyway. It is just handling the logins fine one minute then the next minute its 500 internal error. Do you know where i may find any other logs to help me figure out why the site randomly breaks?

 

If I load my old IIS applicationhost file (renaming) and then rename it back to the SSO working one (above) it fixes the issue but sometimes only for an hour and sometimes for 24 hours. Ultimately ending up in a 500 internal server error.

 

Event code: 4005 
Event message: Forms authentication failed for the request. Reason: The ticket supplied was invalid. 
Event time: 02/11/2015 09:56:21 
Event time (UTC): 02/11/2015 09:56:21 
Event ID: 172fb2690fdb4260bdd86c15c2b5658e 
Event sequence: 14966 
Event occurrence: 1607 
Event detail code: 50201 

Application information: 
   Application domain: /LM/W3SVC/1/ROOT/HAP-6-130909286930396923 
   Trust level: Full 
   Application Virtual Path: /HAP 
   Application Path: C:\inetpub\wwwroot\HAP\ 
   Machine name: W2K12SVCS 

Process information: 
   Process ID: 7932 
   Process name: w3wp.exe 
   Account name: IIS APPPOOL\HAP 

Request information: 
   Request URL: https://hap.domain.com:443/HAP/api/test/?1446458181599 
   Request path: /HAP/api/test/ 
   User host address: 10.18.144.3 
   User:  
   Is authenticated: False 
   Authentication Type:  
   Thread account name: IIS APPPOOL\HAP 

Name to authenticate:  

Custom event details: 

 

We do have WSUS on the same server not sure that would cause any issues? Any help greatly appreciated.

[Sale_El]

just checked the IIS logs and this is the last event before the 500 errors

 

2015-10-31 15:10:10 10.18.144.28 POST /HAP/api/myfiles-upload/N/ - 443 - 90.209.46.215 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_6_8)+AppleWebKit/534.59.10+(KHTML,+like+Gecko)+Version/5.1.9+Safari/534.59.10 https://hap.domain.com/HAP/myfiles/ 413 0 0 5959

 

413 error means files too large, could someone be killing the server with a large file?

 

hmm,

 

Just checked the next time it died and there is no relation to files at all

 

2015-11-01 20:10:08 10.18.144.28 GET /HAP/api/test/ 1446408566389 443 user1 5.69.100.40 Mozilla/5.0+(Windows+NT+6.1;+WOW64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/46.0.2490.80+Safari/537.36 https://hap.domain.com/HAP/ 200 0 0 220

 

 

2015-11-01 20:10:10 10.18.144.28 GET /HAP/api/test/ 1446408609655 443 user2 10.18.144.3 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+6.1;+Trident/7.0;+SLCC2;+.NET+CLR+2.0.50727;+.NET+CLR+3.5.30729;+.NET+CLR+3.0.30729;+Media+Center+PC+6.0;+.NET4.0C;+.NET4.0E) https://hap.domain.com/HAP/ 500 19 126 646