Troubleshooting: HTTP 400 - Bad Request (Request Header Too Long)

Version Affected: All versions
 
 

Overview

Some users see an HTTP 400 error when accessing a SecureAuth realm that has Windows Authentication (IWA) enabled, while other users do not. Affected users are often members of many Active Directory (AD) groups.
 

Cause

When a user logs into a domain-joined workstation, a Kerberos authentication ticket is created that contains the user's AD group membership information. When a browser performs pass-through Windows Authentication, it sends this Kerberos ticket in the request header so that IIS can read the user's information. If a user belongs to many AD groups, their Kerberos ticket can exceed the maximum header size the IIS server (the SecureAuth appliance) allows, causing the HTTP 400 error.
 

Resolution

On the SecureAuth appliance, create or modify two registry values, then restart the HTTP service:

1. Open the Registry Editor (regedit.exe).
2. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters.
3. Right-click the pane on the right and select New > DWORD (32-bit) Value.

4. Name it MaxFieldLength, set Base to Decimal, enter 65534 as the value, then click OK.

5. Create another DWORD (32-bit) value named MaxRequestBytes. Set its value large enough to cover the full request header — for example, 415028 (Decimal) — then click OK.

6. Close the Registry Editor and open a command prompt as Administrator, then run the following commands, waiting for each to finish before running the next:

net stop http
net start http
iisreset

Test again — IIS should now allow the larger request header.
 
 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.