Required Policy for IIS6 Policy Agent

Question

Hello,
I have configured the Policy Agent for MS IIS6 and created a Policy
to enable some users to access the website.
Unfortunately, until now all users get a "403 - Forbidden"-Message.
Users dissallowed by policy get the response immediatly, users
who should have access must wait about 2 Minutes before they
get the error.
When I try to login using a account without permission, this is logged
in the "amAgent"-Logfile:
<--------------->8-------------->8------------------->
2004-08-31 15:10:37.578 128 2912:1567ad8 RemoteLog: User e09mahj0 was denied access to http://erlm630a.ts.siemens.de:81/index.htm.
2004-08-31 15:10:37.593 Error 2912:1567ad8 PolicyAgent: do_redirect(): Error while calling am_web_get_redirect_url(): status = success
2004-08-31 15:10:37.593 Error 2912:1567ad8 PolicyAgent: do_redirect() WriteClient did not succeed: Attempted message = HTTP/1.1 403 Forbidden
<--------------->8-------------->8------------------->
and when using a account who should have access:
<--------------->8-------------->8------------------->
2004-08-31 15:24:20.218 Error 2912:153c360 PolicyEngine: am_policy_evaluate: InternalException in Service::update_policy with error message:Policy query failed. and code:16
2004-08-31 15:24:20.218 128 2912:153c360 RemoteLog: User amAdmin was denied access to http://erlm630a.ts.siemens.de:81/index.htm.
2004-08-31 15:24:20.234 Error 2912:153c360 PolicyAgent: do_redirect(): Error while calling am_web_get_redirect_url(): status = success
2004-08-31 15:24:20.234 Error 2912:153c360 PolicyAgent: do_redirect() WriteClient did not succeed: Attempted message = HTTP/1.1 403 Forbidden
<--------------->8-------------->8------------------->
I have no idea what "PolicyEngine ... code 16 means".
Anyone can help?
Regards,
Juergen Maihoefner

Answer 1

I found that page yesterday, but the errors I'm recieving are well out of the range of errors listed on that page
2008-10-13 16:06:53.578   Error 3232:1c30580 PolicyAgent: do_redirect:  Error while calling am_web_get_url_to_redirect(): status = invalid argument
2008-10-13 16:06:53.578   Error 3232:1c30580 PolicyAgent: do_redirect: WriteClient did not succeed: Attempted message = HTTP/1.1 403 Forbidden Content-Length: 13 Content-Type: text/plain  403 Forbidden Also, there's no firewall between the agent and the server. In my setup, authorized users don't get this message, its only users who aren't authorized to access sharepoint (the server with the agent) who see the 403 page that's just a plaintext '403 Forbidden' message.
Probably the strangest thing about this issue is that when I look at the IIS log, it indicates a 401.5 error (which is correct, as the user should just be denied, not forbidden.
2008-10-13 20:06:44 W3SVC87257621 10.28.204.100 GET /default.aspx - 7000 - 10.28.204.100 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+en-US;+rv:1.9.0.3)+Gecko/2008092417+Firefox/3.0.3 302 0 0
2008-10-13 20:06:53 W3SVC87257621 10.28.204.100 GET /default.aspx - 7000 dan.west 10.28.204.100 Mozilla/5.0+(Windows;+U;+Windows+NT+5.2;+en-US;+rv:1.9.0.3)+Gecko/2008092417+Firefox/3.0.3 401 5 0At the very least, it would be nice to know how the 401 is getting translated into the 403 error, and what would be involved in customizing the error page for this event so that it isn't simply a plaintext message.
Edit:
If you're noticing the timestamp difference of 4 hours, it seems there is a known bug with the w3c extended log file format (http://support.microsoft.com/kb/271196).
Edited by: westd on Oct 14, 2008 5:28 AM