Troubleshooting: HTTP Error 500.19 - Internal Server Error

Version Affected: All
 
 

Overview

Users encounter an "HTTP Error 500.19 - Internal Server Error" when accessing the SecureAuth Identity Provider (IdP) Admin Console or a realm's login page. The requested page cannot be accessed because the related configuration data for the page is invalid.

An Internal Server Error with a status code of 500 on its own is very generic — it only means something went wrong, not what went wrong. The important detail is the specific subcode (500.19 here) and the hex Error Code shown in the Detailed Error Information section of the IIS error page, since that is what actually identifies the cause. See this Microsoft article on understanding and diagnosing HTTP 500 errors for background.

This error has more than one independent cause. Two are identified by the hex Error Code shown in the Detailed Error Information section; a third is identified instead by the IIS log entry for the request:

• See Cause 1 - Error Code 0x8007000d — a problem with .NET (Core) or a .NET module.
• See Cause 2 - Error Code 0x800700b7 — a duplicate header entry in the SecureAuth0 web.config.
• See Cause 3 - No hex Error Code shown; the IIS log for the request shows a sub-status of 19 — a duplicate request filtering entry in a realm's web.config.

These causes are not related, so a fix for one cause will not resolve the other causes.

 

In this article

• Cause 1: Error Code 0x8007000d - .NET (Core) Module Issue
• Cause 2: Error Code 0x800700b7 - Duplicate web.config Header Entry
• Cause 3: Duplicate Request Filtering Entry

Cause 1: Error Code 0x8007000d - .NET (Core) Module Issue

Each version of IdP requires a specific version of .NET (Core) to be installed on the IdP servers. Without it installed correctly, IdP will not function.

The 0x8007000d error has been caused in the past by .NET (Core) not being installed at all, but the more common cause is an earlier version of .NET (Core) being uninstalled after a newer version was installed. Uninstalling one version of .NET (Core) can remove shared parts that other installed versions rely on to run correctly, leaving the server looking correctly configured while actually being broken in the background.

The screenshot below shows the IIS 500.19 error page reporting error code 0x8007000d.

To resolve this:

1. Check the SecureAuth Compatibility Guide for the compatible version of .NET (Core) for your version of IdP.
2. If a compatible version of .NET (Core) is already installed, open Add/Remove Programs and run a Repair against each part of that version.
3. Test Identity Platform again to see if the repair resolved the error.
4. If an incompatible version of .NET (Core) is installed instead, uninstall all parts of that version, then install a compatible version afterward. Install the compatible version after uninstalling the incompatible one, not before.

The screenshot below shows the Repair option for a Microsoft .NET Core - Windows Server Hosting component in Add/Remove Programs.

To download .NET (Core), see the official .NET download page.

Cause 2: Error Code 0x800700b7 - Duplicate web.config Header Entry

This cause was originally documented on IdP 9.0.0, but the same web.config conflict can occur on any on-premises version. It occurs when the SecureAuth0 web.config file contains two <add> entries for the same custom header name inside <customHeaders> — most commonly two entries named Strict-Transport-Security. IIS rejects the duplicate key and throws error code 0x800700b7.

The screenshot below shows the IIS 500.19 error page reporting error code 0x800700b7, with the Config Source section highlighting the duplicate Strict-Transport-Security entry.

To resolve this:

1. Make a copy of the web.config file before making any change.
2. Navigate to D:\SecureAuth\SecureAuth0\web.config.
3. Find the duplicate Strict-Transport-Security entry under <customHeaders>. Your own Config Source section will show the exact line number, matching the pattern below:
   <!--add name="Strict-Transport-Security" value="max-age=31536000" /-->
4. Comment out the duplicate entry using the format shown above.
5. Save the file.

Cause 3: Duplicate Request Filtering Entry

Users receive a generic "500 - Internal server error" when hitting a realm. Unlike the causes above, the IIS error page itself does not show a hex Error Code — the cause is only visible in the IIS log entry for the request, which shows a sub-status of 19 after the main status code, for example:

500 19 13 1

This is caused by a duplicate request filtering entry in that realm's web.config. Request filtering is normally configured at the IIS level, not inside the web.config, so a request filtering entry duplicated in both places causes IIS to reject the configuration.

The screenshot below shows the generic "500 - Internal server error" page a user sees in the browser when this cause applies.

To resolve this:

1. Check the IIS logs for the affected realm and confirm the request shows a 500 status with sub-status 19.
2. Decrypt the web.config for that realm.
3. Look for a duplicate request filtering entry in the decrypted web.config.
4. Remove the duplicate entry, since request filtering should only be set at the IIS level.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.