Olav Aukan Getting information off the Internet is like taking a drink from a fire hydrant…

24Nov/10

400 Bad Request (Header Field Too Long) when using Kerberos authentication

A client was having a problem with his SharePoint installation a while back that really confused me at first. Some users were unable to access their SharePoint 2007 intranet after Kerberos authentication had been configured. Instead of being logged in automatically as expected they received a nize "This page cannot de displayed" in Internet Explorer. The error returned by IIS was "440 Bad Request (Header Field Too Long)".

After some research I stumbled upon this blog post: HTTP/1.1 400 Bad Request (Header Field Too Long) that pointed me to KB-820129. Basically the problem boils down to the difference in the way NTML and Kerberos authentication is performed. With NTLM authentication the client basically sends his username and password to the server which then checks the users memberships by looking up the user in Active Directory. With Kerberos authentication the client basically gets this information from Active Directory himself sends a "token" to the server that contains information about the users memberships. The more AD groups that user is a member of, the bigger the token, and at some point it can become so large that IIS rejects the whole request.

This explained why only some users were having problems, as we discovered that the affected users had dozens of AD memberships, and those AD groups were nested inside other AD groups etc. The solution for us was to modify the following registry keys on all the SharePoint web front end servers in the farm:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters\MaxFieldLength = 65534
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters\MaxRequestBytes = 65534

After the registry modifications have been done the HTTP service and all related IIS services will have to be restarted, as described in the bottom of KB-820129:

To restart the HTTP service, type and all related IIS services, follow these steps:

  1. Click Start, click Run, type Cmd and then click OK.
  2. At the command prompt, type net stop http at a command prompt and then press ENTER.
  3. At the command prompt, type net start http at a command prompt and then press ENTER.
  4. At the command prompt, type net stop iisadmin /y at a command prompt and then press ENTER.

    Note: Any IIS services that depend on the IIS Admin Service service will also be stopped. Notice the IIS services that are stopped when you stop the IIS Admin Service service. You will restart each service in the next step.

  5. Restart the IIS services that were stopped in step 4. To do this, type net start servicename at the command prompt and then press ENTER. In the command, servicename is the name of the service that you want to restart. For example, to restart the World Wide Web Publishing Service service, type net start "World Wide Web Publishing Service", and then press ENTER.
Comments (29) Trackbacks (2)
  1. Thanks for sharing your thoughts. I really appreciate your efforts and I will be waiting for your further
    write ups thank you once again.

  2. I don’t know whether it’s just me or if everybody else encountering problems with your site.

    It appears like some of the text in your content are running off the
    screen. Can someone else please provide feedback and let me know if this is
    happening to them as well? This may be a problem with my internet browser because I’ve had this happen previously.

    Many thanks

  3. The other most typical Assay Workplace marks
    are from Birmingham (an Anchor).

  4. Hi my loved one! I want to say that this post is amazing, great
    written and come with almost all vital infos.
    I would like to look more posts like this .

  5. This illustrated tutorial and suggestions/sources
    from across the net will allow you to design and create your own fairy
    dust necklace.

  6. If you desire to obtain a great deal from this article then you have to apply such methods to your won blog.

  7. I am in fact happy to read this website posts which consists of tons of helpful information, thanks for providing such data.

  8. There’s definately a great deal to find out about this issue.
    I really like all of the points you have made.

  9. Hi! I just wanted to ask if you ever have any troule with hackers?
    My las blog (wordpress) was hacked and I ended up losing several weeks of hard work due to
    no daa backup. Do you have any metghods to protect against hackers?

  10. I know that sounds completely irreconcilable to the cause
    you are actually getting in touch with a spiritual initially.

  11. The walls of this home in Stillwater, Minnesota were bowing in. A totally free quote given by Ingenious revealed PowerBraces were the most effective
    means to fix this issue.

  12. I’ve spent a bit of time reading previous posts on this forum, and have
    had a look at the current screwfix offerings, and think that probably the best I can do for the price is either the FZT250 & Stand, and replace the blade with a professional
    quality one (expecting to pay about 175-180 in total for that bundle), or the FZT250N, again replacing the blade (comes to a shade over 200 probably).

  13. I have and will certainly remain to advise Atlas Structure Repair
    work to anybody requiring structure assistance !!

    • Dee.. You make a very good point, “I can honestly say the days of just having an 80 paydex with 3 50 dollar trades to obtain a staples card are go2&8e#.2n1; You are absolutely correct!

  14. As a full-service foundation repair service business,
    Saber Structure Repair offers a large variety of solutions to take care
    of any kind of structure problem, no matter just how small
    or significant.

  15. If you’re certain of the resource of your home’s structure issue, offer us a telephone call at 866-370-4816, and
    routine a complimentary evaluation.

  16. We assure this product to be devoid of problems in products and workmanship 90 days from the date of purchase.

    • Bank transfer day? How about closings all accounts? The system do;7&n#821set work! THE SYSTEM DOES NOT FUNCTION. The solution isn’t to transfer the money, it’s to get rid of the money! Trading posts seemed to be quite successful at some point in time. What happened to taking care of each other? What happened to humanity? What happened to our Spirit? We’re not just 99%, we are one, WE ARE ALL ONE.

  17. Of stress on the belt as well as it would quit I stalled the belt and
    the motor was still running.

  18. Greetings from Los angeles! I’m bored to tears at your workplace so
    I chose to browse your website on my small iphone during lunch break.

    I enjoy the information you provide here and can’t wait to take a look after i go
    back home. I’m amazed at how fast your blog site loaded in my cell phone ..
    I’m not even using WIFI, just 3G .. Anyhow, good site!

  19. Its like you learn my thoughts! You seem to
    comprehend a great deal about this, just like you wrote the e book in it or
    anything. I believe that you just could do with a few percent to force the content house somewhat, however
    as an alternative to that, that is magnificent blog.
    An incredible read. I am going to certainly come back.

  20. Howdy just wanted to provide a simple heads up.
    The text within your article are running off of the screen in Internet explorer.
    I’m not sure if this is a formatting issue or something related to web browser compatibility but I figured
    I’d post to inform you. The design and elegance look
    great though! I do hope you have the problem solved soon.
    Thanks

  21. You have a lot’s of damage file on your computer. Don’t worry. Just use “Long Path Tool”

    • I got this web sife from my pal whho informed
      me on the topic of this web page and now this time I am
      browsing this wweb site and reading very informative content
      here.

  22. anisa rajib sex
    As I said that she began arch abet against the wall and somehow managed to turn the water on, but it couldn lurk the fact that she was already dribbling raw as I
    sensed her cream bustle down her hip and onto my rockhardon.

  23. bulgarian teenage sex
    Thanks master plz dhere say dabao tormentor chup chap babate rahe dabate dabate unhone mra tio utar diya or me boulderowner nai pahenti me nangi thi unke samne
    or me sharam say pani pani ho rahi thi master.

  24. burkha sex clip
    ‘ opinion you are going to remain home again so when Thea advance around,
    you drill her brains out admire the other day’.

  25. doctoras fallando sexso
    We went at it supahscrewinghot and mighty for awhile.

  26. dad sex bathrom
    I washed my diaphragm, dried it, and placed it into its plastic container.


Leave a comment