ServerXMLHTTP Validation Failures When You Use Extended Characters in User Names

Authentication fails when you use the MSXML2.ServerXMLHTTP class to open a URL with a user name that contains an extended character such as the following: Similar code that uses the Microsoft.XMLHTTP class with the same user name works correctly.

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language. The English version of this fix should have the following file attributes or later:

Use the Microsoft.XMLHTTP class, or apply this hotfix.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

Steps to Reproduce the Behavior

1. On your IIS Web server computer, create a folder that is named TestAccess.
2. Right-click the folder, and then click Properties. On the Directory Security tab, edit the Authentication and Access Control section, and make sure that only Integrated Windows Security is selected.
3. On your Web server computer, create a local NT user name that is named as follows:

   Läder

4. Grant the correct NT permissions for the local NT user that is named:

   Läder

   to read a file from the folder on the Web server.
5. Copy a test XML file that is named test.xml to the TestAccess folder.
6. Create a Visual Basic 6.0 standard form based project, and then add the following code to the project:

   Private Sub Command1_Click()
   Dim objXMLHTTP As Object
   Dim strURL As String
   Dim strUser As String
   Dim strPwd As String
   Dim strWebServer As String
   
     ' Replace MyWebServer below with the name of your Web server.
     strWebServer = "MyWebServer"
     strURL = "http://" & strWebServer & "/testaccess/test.xml"
     strUser = strWebServer & "\L" & Chr(228) & "der"
     strPwd = "Password1" ' Adjust password here as needed.
     
     fUseWorkAround = False
     if (fUseWorkAround) Then
       Set objXMLHTTP = CreateObject("Microsoft.XMLHTTP")
     Else
       Set objXMLHTTP = CreateObject("MSXML2.ServerXMLHTTP")
     End If
   
     Debug.Print "strURL  = " & strURL
     Debug.Print "strUser = " & strUser
     Debug.Print "strPwd  = " & strPwd
   
     objXMLHTTP.open "GET", strURL, False, strUser, strPwd
   
     ' Set request headers.
     objXMLHTTP.setRequestHeader "Content-Type", "text/xml"
   
     ' Send query.
     objXMLHTTP.send
   
     'Display the results.
     If (objXMLHTTP.Status >= 200 And objXMLHTTP.Status < 300) Then
       Debug.Print "Success!"
       Debug.Print "Status       = " & objXMLHTTP.Status
       Debug.Print "StatusText   = " & objXMLHTTP.statusText
     Else
       Debug.Print "Failure!"
       Debug.Print "Status       = " & objXMLHTTP.Status
       Debug.Print "StatusText   = " & objXMLHTTP.statusText
     End If
   
     Set objXMLHTTP = Nothing
   
   End Sub
   					

7. Run the code. Without the hotfix applied, you see the following:

   Failure!
    Status = 401
    StatusText = Access Denied

8. If you set fUseWorkAround as follows:

   fUseWorkAround = True

   in the code, you see the following:

   Success!
    Status = 200
    StatusText = OK