Select the search type
  • Site
  • Web
Search
You are here:  Support/Forums
Support

Bring2mind Forums

Authentication problems after AD Provider change
Last Post 04/27/2010 5:55 PM by Jason Scott. 3 Replies.
Sort:
PrevPrev NextNext
You are not authorized to post a reply.
Author Messages
Jason Scott
New Member
New Member
Posts:46


--
04/08/2010 8:57 PM

We're using DMX 5.1.0 (5.2.2 on our test environment, with same problem) on a DNN 4.8.4 install.

WebDAV Authentication stopped working for us after upgrading our AD Authentication module.  We had previously been using the core DNN AD Authentication provider.  This provider creates DNN user accounts as "domain\username". (not sure if this is relevant info, just including it as a variable)

We recently changed our AD provider to a module called Easy AD, which is exponentially faster at the authentication process.  Using Easy AD, all accounts are still populating with the correct AD groups (DNN Roles).  The main difference is that the "domain\" is now eliminated from the username in the DNN account that is created.   

The only change made to our web.config file was to comment out the following section:

<!-- authentication defaultProvider="ADSIAuthenticationProvider">




Do either of these things (the removal of "domain\" and the removal of the section above) ring a bell on why WebDAV authentication might be failing?  I've run a Fiddler session when we right-click a folder and "Open in Windows Explorer".  After getting a precitable 401 response from the server, the next three responses are as follows:

HTTP/1.1 207 Multi-Status
Date: Thu, 08 Apr 2010 16:18:19 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
WWW-Authenticate: Negotiate oYGgMIGdoAMKAQChCwYJKoZIgvcSAQICooGIBIGFYIGCBgkqhkiG9xIBAgICAG9zMHGgAwIBBaEDAgEPomUwY6ADAgEXolwEWlPKOe9PpO7zIuOUTm/Yf5vr2mDsSuCVWVEXxzOXB9XOCkpBwl1hVTY5Z4V6ZtGkV5kdKSojWslz5YJS4T8n14/CQIZlhxysH70YqVOhOzQafqbwEhiu7pDdJQ==
X-AspNet-Version: 2.0.50727
Content-Length: 752
MS-Author-Via: DAV
X-DMXDav-Version: 5.1.0.0
Cache-Control: private
Content-Type: text/xml

This is followed by another 401:

HTTP/1.1 401 Unauthorized
Content-Length: 1656
Content-Type: text/html
Server: Microsoft-IIS/6.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
Date: Thu, 08 Apr 2010 16:18:20 GMT
Proxy-Support: Session-Based-Authentication

Which is then followed by a third 401:

HTTP/1.1 401 Unauthorized
Date: Thu, 08 Apr 2010 16:18:22 GMT
Server: Microsoft-IIS/6.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
WWW-Authenticate: Digest realm="0@My CVR", nonce="NC84LzIwMTAgMTE6MTk6MjIgQU0",  opaque="0000000000000000", stale=false, algorithm=MD5, qop="auth"
MS-Author-Via: DAV
X-DMXDav-Version: 5.1.0.0
Cache-Control: private
Content-Length: 0
Proxy-Support: Session-Based-Authentication

It appears that IIS is correctly handing this to DMXDav.  I'm having trouble figuring out why it's no longer authenticating.  FYI, we also fail to authenticate when trying to add the folder as a mapped drive. 

Any thoughts?

Peter Donker
Veteran Member
Veteran Member
Posts:4536


--
04/12/2010 2:04 PM
Hi Jason,

I'm wondering if the double WWW-Authenticate is throwing this off. The first is the NTLM challenge, the second (digest) is DMX/DAV. Do you know a way to exclude all paths under dmxdav.axd from NTLM?

Peter
Danny Do
New Member
New Member
Posts:1


--
04/27/2010 5:36 AM

Scott,

Do you ever this the problem resolved. We want to move away from DNN AD provider and use EasyAD but i am concered about WebDav issue. We never get Webdav working with DNN AD provider in place.

 

Danny

 

Jason Scott
New Member
New Member
Posts:46


--
04/27/2010 5:55 PM
Hi, Danny. The one user in my post above appears to be an exception. She's still unable to use WebDAV, but thus far, she's the only user who has found any problems. Our other users aren't having problems with WebDAV. By all accounts, this seems to be a problem with her local machine. I might try out WebDrive or some other WebDAV client. Worst case, we might just re-image her machine. I've been very happy with EasyAD, as long as you don't use double-nested AD groups, which it doesn't support.

Jason
You are not authorized to post a reply.