Prihláste sa s kontom Microsoft
Prihláste sa alebo si vytvorte konto.
Dobrý deň,
Vyberte iné konto.
Máte viacero kont
Vyberte konto, s ktorým sa chcete prihlásiť.
angličtina
Ľutujeme, tento článok nie je dostupný vo vašom jazyku.

When Microsoft Forefront Threat Management Gateway (TMG) 2010 denies a request for an authenticated user, the user receives a "502" error message to inform the user that he or she is denied access. Additionally, the user is not prompted to provide alternative credentials.

The ReturnAuthRequiredIfAuthUserDenied property can be set so that when an authenticated user is denied by the TMG policy, the user receives a "407 Proxy Authentication Required" message. This allows for the user to provide alternative credentials.

For more information about the ReturnAuthRequiredIfAuthUserDenied property, visit the following Microsoft Developer Network (MSDN) website:

ReturnAuthRequiredIfAuthUserDenied Property of the IFPCWebListenerProperties InterfaceIf an administrator creates a deny rule that applies to all users and sets the ReturnAuthRequiredIfAuthUserDenied property to True, a user who is denied by such a rule receives a "407 Proxy Authentication Required" message. This behavior occurs even though all users would be denied by this rule. This behavior may not be desired and could lead to unnecessary authentication prompts.

Symptoms

This behavior is by design. But this behavior may not be the desired behavior because an All Users deny rule blocks all users. Additionally, the prompts for alternative credentials does not resolve this issue.

Cause

To resolve this issue, install the software update that is described in the following Microsoft Knowledge Base article:

2517957 Software Update 1 Rollup 4 for Forefront Threat Management Gateway (TMG) 2010 Service Pack 1After you apply this software update, run the script that is provided in the "More Information" section on one of the TMG array members to set the SkipReauthWhenNonDefaultRule property to True.

Resolution

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Status

This software update introduces a new property, SkipReauthWhenNonDefaultRule. This property provides new behavior. For example, consider the following scenarios.

Scenario 1

An administrator creates an All Users rule that denies access to an authenticated user, and the ReturnAuthRequiredIfAuthUserDenied property is set to True. In this scenario, if the SkipReauthWhenNonDefaultRule property is set to True, the user receives a "502" error message and is not prompted to provide alternative credentials.

Scenario 2

The default rule is applied, and the rule denies the request. Also, the ReturnAuthRequiredIfAuthUserDenied property is set to True. In this scenario, the user receives the "407 Proxy Authentication Required" message as expected.After you apply this software update, run the following script on one of the TMG array members to set the SkipReauthWhenNonDefaultRule property to True. The default setting for the SkipReauthWhenNonDefaultRule property is False.

Note This script will only change the behavior when the ReturnAuthRequiredIfAuthUserDenied property is also set to True.

Const SE_VPS_GUID = "{143F5698-103B-12D4-FF34-1F34767DEabc}"
Const SE_VPS_NAME = "SkipReauthWhenNonDefaultRule"
Const SE_VPS_VALUE = true

Sub SetValue()

' Create the root obect.
Dim root ' The FPCLib.FPC root object
Set root = CreateObject("FPC.Root")

'Declare the other objects needed.
Dim array ' An FPCArray object
Dim VendorSets ' An FPCVendorParametersSets collection
Dim VendorSet ' An FPCVendorParametersSet object

' Get references to the array object
' and the network rules collection.
Set array = root.GetContainingArray
Set VendorSets = array.VendorParametersSets

On Error Resume Next
Set VendorSet = VendorSets.Item( SE_VPS_GUID )

If Err.Number <> 0 Then
Err.Clear

' Add the item
Set VendorSet = VendorSets.Add( SE_VPS_GUID )
CheckError
WScript.Echo "New VendorSet added... " & VendorSet.Name

Else
WScript.Echo "Existing VendorSet found... value- " & VendorSet.Value(SE_VPS_NAME)
End If

if VendorSet.Value(SE_VPS_NAME) <> SE_VPS_VALUE Then

Err.Clear
VendorSet.Value(SE_VPS_NAME) = SE_VPS_VALUE

If Err.Number <> 0 Then
CheckError
Else
VendorSets.Save false, true
CheckError

If Err.Number = 0 Then
WScript.Echo "Done with " & SE_VPS_NAME & ", saved!"
End If
End If
Else
WScript.Echo "Done with " & SE_VPS_NAME & ", no change!"
End If

End Sub

Sub CheckError()

If Err.Number <> 0 Then
WScript.Echo "An error occurred: 0x" & Hex(Err.Number) & " " & Err.Description
Err.Clear
End If

End Sub

SetValue

Note To revert to the default behavior, follow these steps:

  1. Locate the following line in the script:

    Const SE_VPS_VALUE = true
  2. Change the line in the script to the following:

    Const SE_VPS_VALUE = false
  3. Save the script, and rerun this script on one of the TMG Array members.

More Information

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

References

Potrebujete ďalšiu pomoc?

Chcete ďalšie možnosti?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.

Boli tieto informácie užitočné?

Čo sa vám páčilo, prípadne čo nie?
Stlačením tlačidla Odoslať sa vaše pripomienky použijú na zlepšenie produktov a služieb spoločnosti Microsoft. Váš správca IT bude môcť tieto údaje zhromažďovať. Vyhlásenie o ochrane osobných údajov.

Ďakujeme za vaše pripomienky!

×