Access Manager Agent HTTP error 403.0 - Forbidden when accessing IIS web server
Originally Published: 2012-01-13
Last Modified: 2023-10-06
Article Number
Applies To
RSA Product/Service Type: RSA Access Manger 5.0 Agent for IIS 7.0/7.5/8.0/8.5
RSA Access Manger 4.9 Agent for IIS 7.0
RSA Access Manager Agent 4.8 for IIS 6.0
Access Manager Web Agent 4.7 for Apache
Issue
The browser shows the following error message when attempting to access any content on the IIS web server:
HTTP Error 403.0 - Forbidden
You do not have permission to view this directory or page.
Error code 0x00000000
If you view the standard output using debugview or dbwin32 you will see an error similar to the following:
3300: 2012-01-13 09:03:01 -0800 - [2836] - <Config> - Unable to complete initialization 3300: 2012-01-13 09:03:01 -0800 - [2836] - <Config> - Detected invalid or missing configuration parameter(s): 3300: 2012-01-13 09:03:01 -0800 - [2836] - <Config> - 3300: 2012-01-13 09:03:01 -0800 - [2836] - <Config> - Property: 3300: 2012-01-13 09:03:01 -0800 - [2836] - <Config> - cleartrust.agent.sso= 3300: 2012-01-13 09:03:01 -0800 - [2836] - <Config> - Description: 3300: 2012-01-13 09:03:01 -0800 - [2836] - <Config> - Specifies whether single sign-on (cookie) functionality is enabled between this web server and other RSA ClearTrust-protected servers.
Allowed Values:
True
False
Dependencies:
This parameter must be enabled in order to achieve single sign-On within a domain.
3300: 2012-01-13 09:03:01 -0800 - [2836] - <Config> - Invalid or missing value configured for the above property 3300: 2012-01-13 09:03:01 -0800 - [2836] - <Config> - Valid values are 'True' and 'False'. 3300: 2012-01-13 09:03:01 -0800 - [2836] - <Config> - Trusted domain list is empty. 3300: 2012-01-13 09:03:01 -0800 - [2836] - <Config> - Please fix the above problem(s) and restart the web server 3300: Configuration Error 3300: Configuration error, deny user access
No agent log file ctagent.log is created.
Cause
This error indicates the agent failed to start correctly and the web server has been placed in safe mode where no content is being served. This may occur when any fatal configuration error is encountered during the agent startup sequence. You must examine the agent standard output error messages to determine the cause of the failure. There is also the need for asp support to serve up the Access Manager agent pages.It is not enabled on a new IIS instalation.
Resolution
The Access Manager agent is not started until a request is sent to IIS. You must request a web page before the agent will be instantiated.
DBWIN32.EXE
This tool is shipped with the RSA Access Manger 32 bit 4.7 and 4.8 Agent for IIS 6.0 and the RSA Access Manger 4.7 Agent for Apache 2.0 on Windows. The tool is located in the "C:\Program Files\RSA\Access Manager Agent 4.8\IIS\util" directory. This tool can not be used over a remote console; if you attempt to use the tool over RDP the tool will start, but no output will be captured from the agent. If you are using RDP you should use another tool.
Debugview.exe
This tool is created by Microsoft and is freely available for download from the"Sysinternals " web site at the following URL:
This tool works over RDP and can be used to view standard output for both 32 bit and 64 bit applications. For 32 bit applications you must select "Capture win32" and "Capture Global win32" from the menu.
Related Articles
RSA Authentication Agent for Web: IIS Authentication Test Fails Due to Node Secret Mismatch with RSA Authentication Manager Number of Views RSA Authentication Agent for Web 7.1.2 on Microsoft IIS and Windows 2008 Server R2 has http 500 error when protecting ADFS… Number of Views How to Replace the Web Server Certificate for the RSA Identity Governance & Lifecycle Web Console Number of Views Self-Service Console Returns Error 404 Not Found When Accessed via Web-Tier in RSA Authentication Manager 8.x Number of Views Your client does not have permissions to get this URL from the server error with RSA Authentication Agent for Web: IIS Number of Views
Trending Articles
RSA SecurID software token .sdtid file fails to import into RSA SecurID Software Token 5.0 for Windows How to manipulate imported RSA SecurID Software Token(s) on an iPhone or iPad device Authentication Manager Security Console and Operations Console Inaccessible After Certificate Update RSA MFA Agent 2.3.6 for Microsoft Windows Installation and Administration Guide How to 'Trust' the RSA Authentication Manager Security Console Self-Signed Root CA certificate and prevent Cert warnings.
Don't see what you're looking for?
