When Microsoft Forefront Threat Management Gateway (TMG) 2010 denies a request for an authenticated user, the user receives a "502" error message to inform the user that he or she is denied access. Additionally, the user is not prompted to provide alternative credentials.
The ReturnAuthRequiredIfAuthUserDenied property can be set so that when an authenticated user is denied by the TMG policy, the user receives a "407 Proxy Authentication Required" message. This allows for the user to provide alternative credentials.
For more information about the ReturnAuthRequiredIfAuthUserDenied property, visit the following Microsoft Developer Network (MSDN) website:If an administrator creates a deny rule that applies to all users and sets the ReturnAuthRequiredIfAuthUserDenied property to True, a user who is denied by such a rule receives a "407 Proxy Authentication Required" message. This behavior occurs even though all users would be denied by this rule. This behavior may not be desired and could lead to unnecessary authentication prompts.
The ReturnAuthRequiredIfAuthUserDenied property can be set so that when an authenticated user is denied by the TMG policy, the user receives a "407 Proxy Authentication Required" message. This allows for the user to provide alternative credentials.
For more information about the ReturnAuthRequiredIfAuthUserDenied property, visit the following Microsoft Developer Network (MSDN) website:If an administrator creates a deny rule that applies to all users and sets the ReturnAuthRequiredIfAuthUserDenied property to True, a user who is denied by such a rule receives a "407 Proxy Authentication Required" message. This behavior occurs even though all users would be denied by this rule. This behavior may not be desired and could lead to unnecessary authentication prompts.