Consider the following scenario:
- You have a Web server that requires Integrated Windows
authentication.
- A back-end server authenticates the Web server by using Integrated Windows authentication. The back-end server can be a computer that is running Microsoft SQL Server, a file server, or another Web server.
- You publish the Web server in Microsoft Internet Security
and Acceleration (ISA) Server 2006 or in Windows Essential Business Server 2008.
- In the Web listener, you set the authentication method to
HTTP Authentication, and then you click to select the Basic
check box. Or, you set the authentication method to HTML Form
Authentication.
- In the Web publishing rule, you set the Authentication Delegation settings to use the Negotiate (Kerberos/NTLM) authentication method.
In this scenario, the authentication between the Web server and
the back-end server fails. ISA Server 2006 or Windows Essential Business Server 2008 cannot delegate authentication to a back-end server from a published Web server. Depending on the Web server configuration, the client user may see the following different symptoms:
- If the Web server is configured to return a custom error
page, the client user sees this error page.
- If you apply HTML form authentication as the authentication
method, the client user receives the following error message:
You do not have the permissions required to access this
Web site. Please contact the Web site administrator.
Then, the client
user is redirected to the logon form. - If you apply Basic authentication as the authentication
method, the client user is repeatedly prompted for user credentials. If the
client user closes the dialog box that contains the prompt, the user receives the following error
message:
You do not have permission to view this directory
or page due to the access control list (ACL) that is configured for this
resource on the Web server.
HTTP Error 401.3 - Unauthorized: Access is
denied due to an ACL set on the requested resource.