服务器配置错误求助：指向Windows身份认证行的应用报错

Hey there, let's work through this issue together. That error pointing to the authentication mode="Windows" line in your config, combined with remote users not seeing detailed error info, usually boils down to IIS configuration or permission issues. Here's how to troubleshoot and fix it:

1. First, Get Detailed Error Information #

The default security setting blocks remote users from seeing full errors, so let's adjust that temporarily to diagnose the root cause:

• Open your application's web.config file.
• Locate the <customErrors> section (if it doesn't exist, add it inside the <system.web> node).
• Change the mode to Off to allow remote viewing of detailed errors:

  <system.web>
    <customErrors mode="Off" />
  </system.web>
  

Note: Remember to set this back to RemoteOnly or On in production environments to keep your application secure. Alternatively, you can view the detailed error directly on the server's local browser if you don't want to expose it remotely.

2. Troubleshoot Windows Authentication Configuration #

Since the error points to authentication mode="Windows", let's verify key settings:

• Enable Windows Authentication in IIS:

  • Open IIS Manager, navigate to your site, and double-click the "Authentication" feature.
  • Make sure "Windows Authentication" is enabled. If you don't want anonymous access, disable "Anonymous Authentication" here.

• Check Application Pool Identity Permissions:

  • Your app's application pool runs under a specific identity (default is ApplicationPoolIdentity).
  • Go to your site's physical folder, right-click → "Properties" → "Security".
  • Ensure the application pool identity has Read permissions (and Execute if you're running scripts like ASP.NET). If using a domain account, confirm that account has the necessary access to the folder and any backend resources (like databases).

• Verify web.config Authentication Setup:

  • Double-check that the authentication node is correctly placed inside <system.web> with no typos:

    <system.web>
      <authentication mode="Windows" />
      <!-- Optional: Deny anonymous users if needed -->
      <authorization>
        <deny users="?" />
      </authorization>
    </system.web>
    

• Adjust NTLM/Kerberos Providers:

  • If you're in a domain environment, Kerberos authentication might require SPN (Service Principal Name) configuration. To rule this out:
    1. In IIS, go to your site's "Windows Authentication" settings.
    2. Click "Providers" and move NTLM to the top of the list. Test if the error persists.

3. Check Event Viewer for Additional Clues #

Even if you can't see detailed errors remotely, the server's Event Viewer will log the full error details:

• Open "Event Viewer" → navigate to "Windows Logs" → "Application".
• Look for errors related to your application—these will include stack traces and specific issues that might not show up in the browser.

内容的提问来源于stack exchange，提问作者Sreejesh Babu