Using Windows 2008r2, IIS 7.5, I have an application using Windows Integrated Authentication (WWW-Authenticate: NTLM, Negotiate).
In my ASP.NET MVC code, I am overwriting the IIS error page output...
protected void Application_EndRequest(Object sender, EventArgs e)
{
HttpContext context = ((HttpApplication)sender).Context;
if (context.Response.Status.Substring(0, 3).Equals("401"))
{
HttpApplication app = (HttpApplication)sender;
string returnUrl = Response.ApplyAppPathModifier("~/OpenId/AskUser").ToString();
string url = new Uri(this.Request.Url, Response.ApplyAppPathModifier("~/Account/Login?returnUrl=" + returnUrl)).ToString();
app.Response.ClearContent();
app.Response.Write(string.Format("<!DOCTYPE html><html lang=\"en\"><head><meta charset=\"utf-8\"><meta http-equiv=\"refresh\" content=\"0;URL='{0}'\"><title>Error Authenticating</title><script language=\"javascript\">self.location='{0}';</script></head><body>Error Authenticating</body></html>", url));
}
}
The goal is to redirect the user if they are on a non-Windows computer or mobile device (or using Firefox on a Windows PC) to a forms-based login that they can use instead of expecting their Windows credentials via Windows Integrated Auth.
The problem I am encountering with IIS 7.5 on the server is that even though this EndRequest event is firing (I can tell from a X-DEBUG header I inserted in the code and watching fiddler), the HTML output sent back to the client is the IIS 7.5 default error page for http status code 401, not the HTML page I'm outputting. The first time the requeest gets sent (the first request with the 401 response) it works fine, but if the user hits OK with an empty or wrong username/password combination, subsequent 401 responses do not include the proper output in the body of the response (either the default IIS 7.5 401 response page or a simple sentence of text and no HTML).
Note that this does not happen on IIS 7.5 Express on my developer box - it properly outputs the HTML page from the code segment above. This only happens when I deploy the project to the IIS 7.5 web server.
I also tried creating a custom error page... in my web.config I added the following under system.webServer...
<httpErrors>
<remove statusCode="401"/>
<error statusCode="401" prefixLanguageFilePath="" path="ErrorPages/401.html" responseMode="File" />
</httpErrors>
And created and deployed the corresponding HTML file. Once I did that, I no longer got the default IIS 7.5 error page, but now only receive the following terse plain text (not HTML) reply, "You do not have permission to view this directory or page.".
I'm lost as to why IIS Express is outputting everything properly, while IIS 7.5 isn't. Even when I tell IIS 7.5 to output a different page for that type of error, it still wont do it.