Troubleshooting: 404 Error Browsing to a SecureAuth Realm – SecureAuth Support

Version Affected: All

Overview

Browsing to a SecureAuth realm's URL shows IIS's HTTP Error 404.0 - Not Found page, and/or the realm does not appear in the Admin Console's realm list. Endpoints under the realm's path, such as its OpenID Connect (OIDC) /.well-known/openid-configuration or oidctoken.aspx URLs, also return 404.

$IIS 8.5 Detailed Error page showing HTTP Error 404.0 - Not Found for a request to https://localhost/SecureAuth3, with the Physical Path listed as D:\inetpub\wwwroot\SecureAuth3.$

This detailed error confirms the request reached IIS, but IIS has no site or application configured to answer it.

Cause

The realm's application is missing from IIS Manager under the Default Web Site — it was removed, or was never added after the realm's folder was created.

IIS Manager's Default Web Site application list, with a red arrow pointing at a gap in the sequence of SecureAuth realm applications where one is missing.

IIS treats each realm as its own application under the site, so a missing application means IIS has nothing configured to handle requests for that realm's path.

This also applies to realms given a custom ("vanity") name, such as /myapp instead of /SecureAuth61. The custom name is the application's alias in IIS, so if that application was never created on the primary server, the realm returns 404 under its custom URL. FileSync also uses the primary server's IIS applications to create realms on secondary servers, so in that case the realm's folder is usually missing from the secondary servers too.

Resolution:

Make these changes on the primary server. SecureAuth Cloud customers do not have access to IIS — contact SecureAuth Support, who will add the application for you.

Open IIS Manager and right-click Default Web Site.
Click Add Application.
Enter the realm's name as the Alias (for example, SecureAuth3), and set the Application Pool to .NET v4.5. For a realm with a custom name, enter the custom name as the Alias instead (for example, myapp).
Browse to the realm's Physical Path folder (for example, D:\SecureAuth\SecureAuth3).
Click OK.

$Add Application dialog in IIS Manager, with Alias set to SecureAuth3, Application pool set to .NET v4.5, and Physical path set to D:\Secureauth\SecureAuth3.$

The realm is back in IIS Manager and should be reachable again. In a FileSync cluster, check that the realm's folder and IIS application now also exist on each secondary server. If FileSync does not create a custom-named realm on the secondary servers, see Bug: FileSync Does Not Create Vanity-Named Realms on Secondary Servers.

If the realm loads but its OIDC well-known endpoint then returns "Endpoint is disabled", OIDC is not yet enabled on the realm — see Troubleshooting: Well-Known OIDC Endpoint Returns Disabled.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.