Internet Explorer behaviors with Kerberos Authentication

re: Internet Explorer behaviors with Kerberos Authentication

greener85 — Thu, 23 Dec 2010 15:31:17 GMT

Hey bugbunny69,

As far as one IIS Server working vs another could be as simple as the required group membership is in the truncated token on the working vs missing on the failing logon.

If you are not seeing an answer to the 401.1 with www-negotiate response from the IIS server then it sounds like you need to troubleshoot IE if it is not sending any response back.

You will want to make sure that the site you are going to shows up in the intranet zone. After that I would suggest opening a case with our IE team.

HTH,

Rob Greene

re: Internet Explorer behaviors with Kerberos Authentication

BugBunny69 — Tue, 21 Dec 2010 15:33:38 GMT

Hi Rob,

Thanks a lot for your answer. Unfortunately I don't have direct access to the end users computers but will check the MaxTokenSize asap.

There is however still something unclear in my head. If the issue is related to the token size, how is possible that access to one IIS server works and not to the other one while both servers seem to hae the same config? FYI, when I do a Wireshark, I see the request sent by IE to IIS, then the negotiate answer sent by IIS to IE and then nothing.

Thanks,

Benoit

re: Internet Explorer behaviors with Kerberos Authentication

greener85 — Fri, 17 Dec 2010 18:36:50 GMT

Hey BugBunny69,

From the error you are stating that you are seeing it sounds like you have a problem with your Kerberos ticket size.

By default a Kerberos ticket can only be 12k in size, but is allowed to get to 65,535. You can use the MaxTokenSize registry key value to set this.

However, with IIS, since the Kerbeos ticket is sent in the HTTP header, you are also going to run into a problem there also because by default (for security reasons) the HTTP header size is only allowed to be 16k.

So you will need to make some changes within IIS, and every computer in the mix and add MaxTokenSize to them (you can exclude domain controllers)

MaxTokenSize:

938118 How to use Group Policy to add the MaxTokenSize registry entry to multiple computers

support.microsoft.com/default.aspx

327825 New resolution for problems with Kerberos authentication when users belong to many groups

support.microsoft.com/default.aspx

NOTE: The hotfix is not needed unless you are on Windows 2000.

Also, just as a side note, if you make sure that your forest / domain functional levels are atleast Windows Server 2003, you might fix your self if you are currently at Windows 2000 levels. This is because we use RID values for global group memberships after that.

For IIS 6 and above you need to modify the following two registry keys:

MaxRequestBytes

MaxFieldLength

2020943 "HTTP 400 - Bad Request (Request Header too long)" error in Internet Information Services (IIS)

support.microsoft.com/default.aspx

Hope this helps.

Rob Greene

re: Internet Explorer behaviors with Kerberos Authentication

BugBunny69 — Tue, 14 Dec 2010 17:23:56 GMT

Hi,

We have a very strange behaviour with IE. Could you please help?

I have two IIS 6.0 servers (A and B).

Both are configured to use Integrated Windows Authentication.

1) Access to both servers works fine for hundreds of users.

2) For a very limited number of users access works fine for server A but not for server B if access is done with Internet Explorer (same issue with IE6 and IE8). For these users, access works fine for both servers if they use Firefox or Chrome.

3) When I check their event log, I can see:

"The kerberos SSPI package generated an output token size of size 3514 bytes, which was too large to fit in the 3510 buffer provided by process id 0."

The solution to this issue was to reduce the number of groups of the impacted users.

My question: how is it possible that access was working for one server and not the other one before the group reduction?

Thanks,

Benoit

Internet Explorer behaviors with Kerberos Authentication

Internet Explorer behaviors with Kerberos Authentication — Tue, 23 Jun 2009 09:38:46 GMT

PingBack from http://www.marcvalk.net/2009/06/internet-explorer-behaviors-with-kerberos-authentication/