Hi Guys,
After about 4 hours on a case, I have figured out what is causing this issue. I am able to replicate this in the lab as well.
This issue is what is sent in the 401 Unauthorized from TMS. The working message stream is as follows:
1. VCS sends 4 GET messages to TMS (1 for each TMSPE service)
2. TMS sends a 401 Unauthorized with the following 3 lines:
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
WWW-Authenticate: Basic
3. VCS sends 4 GET messages with a selected authentication method
The failed message stream is as follows:
1. VCS sends 4 GET messages to TMS (1 for each TMSPE service)
2. TMS sends a 401 Unauthorized with the following 3 lines:
WWW-Authenticate: Basic
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
3. VCS doesn't send anything
Notice how Basic authentication is listed first. When the VCS receives the 401 it doesn't send the GET messages at all. This is the issue at hand. The VCS is expecting Basic to be listed in the 3rd spot. You can still change the order of NTLM or Negotiate by following the steps in my previous post.
To change the order of the Basic message you need to change the order in which it lists in the modules portion of IIS.
From what I have found you will most likely have to modify the applicationHost.config file. In the GUI you can move this up using the modules section but I have found that the items are locked and are unable to move in the GUI.
The file is located in C:\Windows\System32\inetsrv\config
To fix it I have written the following steps below:
1. Backup the applicationHost.config file
2. Stop the WWW Publishing service on the Windows server
3. Edit the applicationHost.config file by opening it in Notepad
*WARNING: This file contains a lot of information that pertains to IIS. If the file is not modified correctly you might have to end up uninstalling and re-installing everything.*
4. Search/Find the string "" without quotes
You should find only two of them
Look for the one that looks like this:
5. Look below the modules tag and find the line with:
6. Move the above line in step 5 line anywhere above the following two lines still underneath the tag.
If the BasicAuthentiacationModule line is below the WindowsAuthenticationModule lines in the file, the Basicauthentication line in the 401 from TMS will be at the top causing failure.
7. Save the file which is located in C:\Windows\System32\inetsrv\config
8. Start the WWW Publishing service
9. Disable and re-enabled the services on the VCS
Let me know if you have further questions.
Chad
