Arrrgh Sharepoint - problems with external users access

[sidewinder]

I've setup a Sharepoint 2010 site as a portal for governors to use - it works fine for me both externally and internally from every browser possible. Same for my boss, so we go live with it and start putting documents on it.

 

However half of the people who need to access it are unable to do so - all they get is the login prompt, they enter details and they are shown it again, as if the password is wrong, but I have checked and they are using the correct credentials. I can login as those users from anywhere so no problem with accounts.

 

At first I thought it was to do with IE, but just had a governor unable to login with Chrome either.

 

It is running basic authentication with SSL. I went basic to avoid them having to type domain\username.

 

I've looked in the IIS logs, it shows where someone has tried to access it, but it does not show anything about access denied. I assume the following is 2 attempts.

 

2012-02-03 16:21:17 192.168.1.13 GET / - 443 - 109.238.71.252 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/5.0) 401 2 5 231
2012-02-03 16:21:17 192.168.1.13 GET / - 443  109.238.71.252 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/5.0) 401 1 1326 344
2012-02-03 16:21:52 192.168.1.13 GET / - 443  109.238.71.252 Mozilla/5.0+(compatible;+MSIE+9.0;+Windows+NT+6.1;+WOW64;+Trident/5.0) 401 1 1326 380
2012-02-03 16:25:37 ::1 GET /_vti_bin/sitedata.asmx - 80 - ::1 Mozilla/4.0+(compatible;+MSIE+4.01;+Windows+NT;+MS+Search+6.0+Robot) 403 4 5 1

 

Does the 401 refer to a HTTP 401 error?

 

Whereas a successful login by me as the same user looks like this:

 

2012-02-03 16:31:52 192.168.1.13 GET / - 443  82.113.231.63 Mozilla/5.0+(Windows+NT+6.1)+AppleWebKit/535.7+(KHTML,+like+Gecko)+Chrome/16.0.912.77+Safari/535.7 200 0 0 86
2012-02-03 16:31:52 192.168.1.13 GET /SitePages/Home.aspx - 443  82.113.231.63 Mozilla/5.0+(Windows+NT+6.1)+AppleWebKit/535.7+(KHTML,+like+Gecko)+Chrome/16.0.912.77+Safari/535.7 200 0 0 724
2012-02-03 16:31:53 192.168.1.13 GET /SiteAssets/SitePages/Home/extranet.jpg - 443 readhead.s 82.113.231.63 Mozilla/5.0+(Windows+NT+6.1)+AppleWebKit/535.7+(KHTML,+like+Gecko)+Chrome/16.0.912.77+Safari/535.7 304 0 0

 

Obviously we're using different browsers there, what does his refer to though? Because he said he is using IE (and later Chrome) but that looks like Firefox?

 

Any ideas anyone?

[EduTech]

When they attempt to login does it keep prompting for the credentials or does it accept them and show you an 'Access Denied' page?

 

Have you made sure that the users are in the groups you are using on your sharepoint sites? i.e. Viewers, Members, Owners?

 

I am guessing you cannot login with their accounts to sharepoint internally?

 

James.

[MatthewL]

Do they have to be member of a group in AD?

 

Are you a domain admin - hence why you might be able to access it.

[sidewinder]

It just keeps on prompting them.

 

Not the accounts since I can use their account to log in externally on IE, Firefox and Chrome.

 

The only thing I can think is that it is something to do with their browser settings but without being able to reproduce it, it's hard for me to tell them what to do!

 

Some of them are accessing it fine though

[MatthewL]

Have you added the site to trusted sites to see if this works?

[sidewinder]

I can get them to try that I guess.

 

Part of the problem is that being governors, they are spread all over the place so I can't see them face to face, and I can already sense a few of them are getting a bit annoyed at this when it should have 'just worked' so I don't want to keep sending them suggestions without knowing it's likely to work

[MatthewL]

I don't know alot about Sharepoint as we don't use it any more but its just going on similar isseus we have had.

[TheMan100]

Have you tried to disable all other types of authentication on the Sharepoint, apart from basic?

[EduTech]

Is it not possible for you to remotely connect to one of the computers when one of them are available, troubleshoot it and then you may have an answer to give to all of them as a whole.

 

James.

[sidewinder]

Have you tried to disable all other types of authentication on the Sharepoint, apart from basic?

 

Just tried this - noticed that although IIS was only set to basic, I still had Sharepoint set to Windows and Basic, so I've disabled Windows on SP now.

Fingers crossed...waiting to hear back.

[sidewinder]

Well I've heard back from him, he is still unable to log in with IE at home or at work, but can now log in at work with Chrome (I think Chrome probably worked all along - PICNIC)

 

I've been looking at the IIS logs all morning and it seems like both the governors who cannot log in are using IE9, and it is definitely logging a 401 error when they try to enter their password. I've tried with IE9 myself and annoyingly it works fine.

 

Read a bit about problems acknowledged with the 64Bit version of IE9 (this looks like what one of them is using due to the WOW64 in the browser string) and also IE9 on older versions of Windows (surely that is just Vista?) but no fixes.

 

So I think I might have to admit defeat on this one, unless anyone has any ideas. It seems like they can all log in with Chrome or Firefox so they can access it, it is just ridiculous that they cannot login to a MS product with IE

[jamesb]

Does the 401 refer to a HTTP 401 error?

 

Yep - most likely they're putting in their password wrong. It'll prompt three times usually (sometimes more) before booting them to an access denied page.

 

Is it only basic authentication that you have enabled, or are there other methods available within IIS? If there are other methods enabled, switch them off so that the only available authentication scheme is basic. IE will often default to NTLM if it's available.

[sidewinder]

Everything is off except basic (and some ASP authentication which looks like it shouldnt be turned off)

 

The error is indeed the same as if they are putting in their password wrong, however as they can log in from Chrome I will give them the benefit of the doubt and assume they are inputting it correctly (though I suppose they could have typed it wrong first time and saved it, but seems unlikely)

[TheMan100]

Strange... I remember having a problem like this in Server 2008 with RD Web Access, it was because of Windows Authentication and Basic Authentication being on at the same time which caused it. It also had the same problems you're describing, some can log in, some can't etc. I'm surprised it hasn't fixed it, and struggling to think of what else it could be.

[sidewinder]

Yeah I'm surprised too

I've attached some screenshots just in case im being really stupid. Sharepoint authentication type is set to Windows but that is correct isnt it? There is no basic option?

The option I changed yesterday was the IIS authentication section within sharepoint

 

[TheMan100]

I'm stumped. The last thing I would try is disabling asp authentication, but I doubt that will help anything, and could make it worst. Hopefully somebody with a bit more knowledge of IIS and Sharepoint will see this thread and help out.

[steve]

We have this issue too. Only way we've found to use ie is with DOMAIN\username

 

Firefox works with just username