FIX: You are prompted for credentials when you click a user name on an ASP.NET 2.0-based SharePoint application if FBA is used

Consider the following scenario:

• You use forms-based authentication (FBA) in a Microsoft ASP.NET 2.0-based Microsoft SharePoint application.
• You log on to the SharePoint site, and then you click a user name on a page.
  
  For example, you click a user name under the Modified By field in a document library.

In this scenario, you are prompted unexpectedly for credentials.�

If you enter your credentials, you are repeatedly prompted to enter them again. Additionally, a blank page appears after you enter your credentials three times.

Note Internet Information Services (IIS) generates a 401 HTTP status code for this issue.

This issue occurs because the FBA module of ASP.NET 2.0 uses the ReturnUrl query string parameter for authentication. However, the SharePoint site also uses the ReturnUrl query string parameter.

To resolve this issue, apply the following hotfix. After you apply the hotfix, configure the following settings in the Web.config file of the SharePoint application:

Hotfix information

A supported hotfix is now available from Microsoft. However, it is intended to correct only the problem that is described in this article. Apply it only to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Service Pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Customer Support Services to obtain the hotfix. For a complete list of Microsoft Customer Support Services telephone numbers and information about support costs, visit the following Microsoft website:Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

To apply this hotfix, you must have the Microsoft .NET Framework 3.5.1 installed on one of the following operating systems:

• Windows Server 2008 Service Pack 2 (SP2)
• Windows Vista Service Pack 2 (SP2)
• Windows 7
• Windows 7 Service Pack 1 (SP1)
• Windows Server 2008 R2
• Windows Server 2008 R2 Service Pack 1 (SP1)

Restart requirement

You do not have to restart the computer after you apply this hotfix.

File information

The version of this has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported x86-based versions of Windows 7For all supported x64-based versions of Windows 7 and of Windows Server 2008 R2 For all supported IA-64�based versions of Windows Server 2008 R2 For all supported x86-based versions of Windows Server 2008 and of Windows Vista For all supported x64-based versions of Windows Server 2008 and of Windows Vista For all supported IA-64�based versions of Windows Server 2008

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

For more information about forms authentication in ASP.NET 2.0, visit the following MSDN website:

For more information about the HTTP status codes in IIS 7.0, click the following article number to view the article in the Microsoft Knowledge Base: