I have an IIS server which is hosted one website using default port number 80 and it is bind to mywebsite1.com:80. It is able to view using its domain mywebsite1.com without any issue. Now I hosted another website using port no 70 and need to bind mywebsite2.com to it. But since DNS record not supporting to the port numbers, I am able to view my newly hosted website using the URL mywebsite2.com:70. Is there any way to avoid putting port no there and access the website using its domain mywebsite2.com directly.
Windows Version : Windows Server 2016,
IIS Version : 10.0.14393.0
Thanks #Dusan Bajic and #Lex Li for the guidance. I was able to solve this issue by ticking the “Require Server Name Indication” in IIS site bindings.
Reference : https://www.sherweb.com/blog/cloud-server/host-different-ssls-on-one-ip-with-iis-8-sni/
Then i set up the HTTP/HTTPS redirect in IIS and now everything working fine,
(https://www.namecheap.com/support/knowledgebase/article.aspx/9953/38/iis-redirect-http-to-https)
I have a site which is configured in IIS7. Currently, the site named Site1, which uses the https protocol with a custom port number 5001. I can access this site by using the url given below:
https://demo.mydomain.com:5001/Site1
I need to eliminate the port number from the url, but it should access the same content which is used by the url "https://demo.mydomain.com:5001/Site1".
Expected result should be like this: "https://demo.mydomain.com/Site1"
Any help is much appreciated.
In IIS Manager, click on the Site (left pane) and the click Bindings (right pane). You'll see a binding for port 5001. Edit that binding to be port 443. (https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/site/bindings/binding)
My guess though is you have some other site that is bound to port 443, if that is the case you either need to remove it from the other site, or if you need them to coexist, you need to dig into SNI which is a bit more advanced topic (SNI and SSL on IIS 8.5)
I am trying to add the RequireHttps tag to a controller action but when I try to navigate to it I get a page not found error when I try:
https://localhost/MVCDemo3_4/Home/Index2
or
http://localhost/MVCDemo3_4/Home/Index2
The Http one tries to redirect to HTTPS but then the HTTPS can't find the page.
It depends more on how this is being hosted than the MVC attribute. If it's running off of a real IIS (or other full httpd) server on locahost, then you just need to make sure IIS is listening on both 80 and 443 (as #Jester mentioned, check the bindings). However, if you are using IIS Express via Visual Studio, then you really can only listen on one port and your debugging needs to be either all non-SSL or all SSL. This is controlled through the propeties on the Web project. Look at the Project URL field.
When I debug my asp.net mvc3 web application on http://localhost:11118/ using microsoft visual studio and it works perfectly.
But when I try to view it on http://MYPUBLICIPADRESS:11118/ I get a HTTP Error 404. The requested resource is not found. message. I portforwarded port 1118 correctly. I have no problems doing the same using apache.
How can I get this to work?
The Visual Studio internal server only accepts connection coming from localhost. You should use IIS Express (and manually change the config file) to let it accept connection using other hostnames, including the computer name.
You can read more about setting the server of your preferences on MSDN
I've just built a basic ASP MVC web site for deployment on our intranet. It expects users to be on the same domain as the IIS box and if you're not an authenticated Windows User, you should not get access.
I've just deployed this to IIS6 running on Server 2003 R2 SP2. The web app is configured with it's own pool with it's own pool user account. The IIS Directory Security options for the web app are set to "Windows Integrated Security" only and the web.config file has:
<authentication mode="Windows" />
From a Remote Desktop session on the IIS6 server itself, an IE7 browser window can successfully authenticate and navigate the web app if accessed via http://localhost/myapp.
However, also from the server, if accessed via the server's name (ie http://myserver/myapp) then IE7 presents a credentials dialog which after three attempts entering the correct credentials eventually returns "HTTP Error 401.1 - Unauthorized: Access is denied due to invalid credentials".
The same problem occurs when a workstation browses to the web app url (naturally using the server's name and not "localhost").
The IIS6 server is a member of the only domain we have and has no firewall enabled.
Is there something I have failed to configure correctly for this to work?
Thanks,
I have tried the suggestions from Matt Ryan, Graphain, and Mike Dimmick to date without success. I have just built a virtual machine test lab with a Server 2003 DC and a separate server 2003 IIS6 server and I am able to replicate the problem.
I am seeing an entry in the IIS6 server's System Event Log the first time I try to access the site via the non-localhost url (ie http://iis/myapp). FQDN urls fail too.
Source: Kerberos, Event ID: 4
The kerberos client received a KRB_AP_ERR_MODIFIED error from the server host/iis.test.local. The target name used was HTTP/iis.test.local. This indicates that the password used to encrypt the kerberos service ticket is different than that on the target server. Commonly, this is due to identically named machine accounts in the target realm (TEST.LOCAL), and the client realm.
After extensive Googling I managed to find a solution on the following MSDN article:
How To: Create a Service Account for an ASP.NET 2.0 Application
Specifically the Additional Considerations section which describes "Creating Service Principal Names (SPNs) for Domain Accounts" using the setspn tool from the Windows Support Tools:
setspn -A HTTP/myserver MYDOMAIN\MyPoolUser
setspn -A HTTP/myserver.fqdn.com MYDOMAIN\MyPoolUser
This solved my problem on both my virtual test lab and my original problem server.
There is also an important note in the article that using Windows Authentication with custom pool users constrains the associated DNS name to be used by that pool only. That is, another pool with another identity would need to be associated with a different DNS name.
Sounds like the new Loopback check security feature of Windows Server 2003 SP1. As I understand it, is designed to prevent a particular type of interception attack.
From http://support.microsoft.com/kb/896861
SYMPTOMS
When you use the fully qualified domain name (FQDN) or a custom host header to browse a local Web site that is hosted on a computer that is running Microsoft Internet Information Services (IIS) 5.1 or IIS 6, you may receive an error message that resembles the following:
HTTP 401.1 - Unauthorized: Logon Failed
This issue occurs when the Web site uses Integrated Authentication and has a name that is mapped to the local loopback address.
Note You only receive this error message if you try to browse the Web site directly on the server. If you browse the Web site from a client computer, the Web site works as expected.
CAUSE
This issue occurs if you install Microsoft Windows XP Service Pack 2 (SP2) or Microsoft Windows Server 2003 Service Pack 1 (SP1). Windows XP SP2 and Windows Server 2003 SP1 include a loopback check security feature that is designed to help prevent reflection attacks on your computer. Therefore, authentication fails if the FQDN or the custom host header that you use does not match the local computer name.
Workaround
Method 1: Disable the loopback check
Method 2: Specify host names
See http://support.microsoft.com/kb/896861 for details.
Edit - just noticed that you said you were seeing this from Client PCs as well... that's more unusual. But I'd still look to test one of these workarounds, to see if it corrected the problem (and if so, might indicate a problem with your DNS config).
It sounds to me as though you've done everything right.
I'm sure you are but have you made sure you are using 'DOMAIN\user' as the user account and not just 'user'?
IE7 only sends Windows credentials (NTLM, Kerberos) if it identifies the server as being on the Intranet. IE7 also added an Intranet zone lockdown feature - if you're not on a domain, by default no servers are in the Intranet zone. This was done to prevent zone-migration attacks.
To change this, go to Tools/Internet Options, Security tab, then click Local Intranet. You can then manually add servers that should be treated as Intranet, by clicking the Sites button, then Advanced, or tell IE not to automatically detect your Intranet and selecting the other checkboxes as appropriate.
I just encountered the opposite problem - my site authenticates externally but not locally.
I compared it to the sites we have working and the difference was that the site that failed to authenticate was using Windows Authentication.
However, other sites I work with (this is a dev server) tend to have Basic Authentication.
Not sure why exactly but this fixed it.
However, at the same time I noticed "Default Domain" and "Realm" settings.
I know it's very unlikely but could these perhaps help at all?