Microsoft KB Archive/315909

= PRB: &quot;Proxy Authentication Required&quot; Error Message with ServerXMLHTTP Object =

Article ID: 315909

Article Last Modified on 5/12/2002

-

APPLIES TO


 * Microsoft XML Core Services 4.0
 * Microsoft XML Parser 3.0 Service Pack 1
 * Microsoft XML Parser 3.0 Service Pack 2
 * Microsoft XML Core Services 4.0

-



This article was previously published under Q315909



SYMPTOMS
When you use an Active Server Pages (ASP) application that uses the ServerXMLHTTP object to retrieve data from servers through a proxy server, and the virtual directory or Web site where the application resides is configured for Anonymous access, you may receive the following error message:

Proxy Authentication Required

You must authenticate with a proxy server before this request can be serviced.

Please try the following: Log on to your proxy server and try again. If you believe you should be able to view this directory or page, please contact the Web site administrator by using the e-mail address or phone number listed on the MyServer  home page.

HTTP 407 - Proxy Authentication Required

This problem may persist even if the server is using the correct proxy settings through Proxycfg, and even if the application is passing proxy credentials with the setProxyCredentials method.



CAUSE
This problem occurs with proxy servers that use Microsoft Windows NT Challenge/Response (NTLM) authentication. When the application requests access to external Web sites, the proxy server sends a &quot;challenge,&quot; requesting the credentials of the user who wants this access. Because the authentication method of the Web site is Anonymous, Internet Information Services (IIS) replies with the credentials of the anonymous account (IUSR_MachineName). By default, IUSR_MachineName is a local account known only to the IIS server. The proxy server refuses access because it does not recognize the name.

This applies to both IIS versions 4.0 and 5.0.



RESOLUTION
Make sure that the Account Used for Anonymous Access property of the virtual directory or Web site is set to a domain account. By default, this is set to a local account.



STATUS
This behavior is by design.



Steps to Reproduce the Behavior
NOTE: You need to have knowledge of proxy servers and IIS servers to test this procedure.  Set up a proxy server and set it to use only NTLM authentication. Configure a virtual directory in IIS to allow Anonymous access with the default anonymous account (IUSR_MachineName).  In the virtual directory, create an ASP page that accesses a server through the proxy server that you configured in step 1. The following sample ASP code uses Microsoft Visual Basic Scripting Edition (VBScript): <% Response.ContentType=&quot;text/xml&quot; Dim xmlServerHttp set xmlServerHttp = Server.CreateObject(&quot;Msxml2.ServerXMLHTTP.4.0&quot;) xmlServerHttp.open &quot;GET&quot;, &quot;http://www.w3.org/xml/1998/06/diffspec.xsl&quot;, False xmlServerHttp.setProxyCredentials &quot;myUser&quot;, &quot;myPassword&quot; xmlServerHttp.send Response.Write xmlServerHttp.responsetext %>



