Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 1881

Changing IIS user breaks Chrome

$
0
0

In order to make use of a command-line SSH utility, we switched the user of our IIS application pool to a user which has access to it. I am not sure why the NETWORK SERVICE user or the AppPoolIdentity can't access the SSH program. So, there's two possible fixes here - either make the site work with Chrome with the user switch, or make the regular users be able to use the SSH program - I prefer the latter.

This user switch is causing the NTLM to fail, but only in Chrome. Does anybody know the difference? I can show the Fiddler transcripts of the two browsers...

IE does this...

GET http://wmdt-test/special_pages/DisputeManager.aspx HTTP/1.1
Host: wmdt-test
Connection: keep-alive
Authorization: NTLM {HugeToken}=
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,de;q=0.6
---------------------------------------------------------------------------------
GET http://wmdt-test/special_pages/DisputeManager.aspx HTTP/1.1
Host: wmdt-test
Connection: keep-alive
Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw==
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,de;q=0.6
----------------------------------------------------------------------------------
GET http://wmdt-test/special_pages/DisputeManager.aspx HTTP/1.1
Host: wmdt-test
Connection: keep-alive
Authorization: NTLM {HugeTokenAgain}
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,de;q=0.6
----------------------------------------------------------------------------------

That last request gets the 200. In Chrome though, it goes completely another way... it gets 401 on all three requests.

GET http://wmdt-test/special_pages/DisputeManager.aspx HTTP/1.1
Host: wmdt-test
Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,de;q=0.6
----------------------------------------------------------------------------------
GET http://wmdt-test/special_pages/DisputeManager.aspx HTTP/1.1
Host: wmdt-test
Connection: keep-alive
Authorization: Negotiate {HugeToken}=
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,de;q=0.6
-----------------------------------------------------------------------------------
GET http://wmdt-test/special_pages/DisputeManager.aspx HTTP/1.1
Host: wmdt-test
Connection: keep-alive
Authorization: NTLM {Different HugeToken}=
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.107 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,de;q=0.6

I do not understand why changing the user on IIS causes the browser to act so differently, and why it only affects Chrome?


Viewing all articles
Browse latest Browse all 1881

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>