Got a website hosted under IIS 10 using Windows Authentication. I can browse to the site but for the sections on the page that use AJAX a login dialog box pops up. Entering in the correct credentials doesn't work and the login box keeps prompting. If I click cancel on the login dialog box, then a 401 error is displayed for the AJAX section. I have confirmed the service account used for the app pool has access to the home folder of the web content as well as the IIS_IUSRS and Users groups. Is there something else I am missing? I tried a slew of other things: Adding ajax property withCredenitals as true. Turning off extended protection in Windows Authentication Advanced Settings. Enabling/disabling Kernel-mode-authentication in Windows Authentication Advanced Settings. Changing the order of Negotiate and NTLM in Windows Authentication Providers Modifying web.config file to allow anonymous authentication only for Options but denied for Get, Post, Put, Delete.

AJAX calls don't have credentials attached by default. Can you post the code you're using to make the actual AJAX calls on the client side? I'm assuming here the entire site is using Windows auth and not just a subset. If you're using legacy ASP.NET code then look in the web.config for the location elements. These determine which URLs need authentication and which do not.

IIS 401 Error Using Windows Authentication and AJAX

Accepted answer

Michael Taylor 55,476 Reputation points

2022-10-14T19:42:24.653+00:00

AJAX calls don't have credentials attached by default. Can you post the code you're using to make the actual AJAX calls on the client side?

I'm assuming here the entire site is using Windows auth and not just a subset. If you're using legacy ASP.NET code then look in the web.config for the location elements. These determine which URLs need authentication and which do not.
Please sign in to rate this answer.
K G name 21 Reputation points

2022-10-14T20:28:30.127+00:00

Attached is the configuration of the AJAX call on the client side. The entire site is using Windows Auth that is correct. Also, I attached the web configs and site structure to provide more insight because I have one main site with virtual directories.

Michael Taylor 55,476 Reputation points

2022-10-14T20:39:57.657+00:00

Only the first screenshot came through.

For your AJAX call you need to set the withCredentials property to true so the browser includes the credentials when making the call.

$.ajax({ type: 'POST', url: '', xhrFIelds: { withCredentials: true } });

I'm assuming here that the API and site are on the same domain. I do notice that you rooted your URL. That means your site has to be hosted as a website in IIS and not as an app under the default website. Rooted paths do not resolve correctly in that case.

K G name 21 Reputation points

2022-10-14T20:50:23.78+00:00

Alright, let me know if you can see all 4 images in my last post now.

The attached screenshot shows adding the withCredentials: true

K G name 21 Reputation points

2022-10-14T20:58:02.15+00:00

After adding the withCredentials on Client AJAX, I redeployed in IIS but same thing occurring. The AJAX content is prompting for credentials indefinitely.

Michael Taylor 55,476 Reputation points

2022-10-14T21:45:31.117+00:00

I can see the screenshots.

Your config file is referencing aspnetcore, not aspnet. Are you trying to host asp.net core in an aspnet app? You don't have any custom location settings configured so that isn't an issue for the underlying problem.

Your site appears to be hosted under assets. Therefore your root path isn't going to work. When it is rooted like that the browser strips off everything other than the host. So if you access your site like https://mydomain.mycompany.com/Assets then the browser takes /Home/PopulateAssetEmployee and rewrites it to https://mydomain.mycompany.com/Home/PopulateAssetEmployee. You lose the app name.

K G name 21 Reputation points

2022-10-14T21:59:11.157+00:00

Sweet, just solved the issue. You mentioned rooted path and after checking the path trying to be accessed it was because the url need to be routed to one more directory in front of home. For example, I had

url: "/Home/PopulateAssetSubGroupDefault",

but I needed it to route to the following

url: "/Assets/Home/PopulateAssetSubGroupDefault",
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

IIS 401 Error Using Windows Authentication and AJAX

0 additional answers

Your answer