View Issue Details

Related ChangesetsJump to NotesJump to History
This issue affects 1 person(s).
 8
IDProjectCategoryView StatusDate SubmittedLast Update
20692Bug reportsQuestion editorpublic2026-09-15 12:422026-09-21 21:30
ReporterDHSUbk Assigned Toc_schmitz  
PrioritynoneSeveritypartial_block 
Status closedResolutionfixed 
Summary20692: Authwebserver issue with new editor
Description

The new editor is not working properly on IIS when I have site-authentication set to:
Anonymous Authentication = Disabled
Windows Authentication = Enabled
LimeSurvey Plugin Authwebserver = Enabled
'urlFormat' => 'path'

Once I click on "Edit Survey" the browser triggers the Windows security prompt and asks for Username/Password.

Steps To Reproduce

Steps to reproduce

  1. Setup clean installation of LimeSurvey
  2. Set Folder permissions for IIS_IUSRS on tmp, upload, config folders
  3. Set IIS authentication method to
    Anonymous Authentication = Disabled
    Windows Authentication = Enabled
  4. Login to LimeSurvey with DB authentication (admin) and create new user with sAMAccountName
  5. Enable Authwebserver plugin and configure REMOTE_USER
  6. Change config.php of LimeSurvey to 'urlFormat' => 'path' --> to get the new Editor
  7. Close Browser and reopen to autologin with the Windows-Users (SSO)
  8. Create or Edit existing survey

Expected result

Expected result is that the editor is opening and i can add/modify the questions.

Actual result

Browser (Edge in our case) is triggering the Windows security prompt to enter Username/Password)

TagsNo tags attached.
Attached Files
Checking permissions.png (48,049 bytes)   
Checking permissions.png (48,049 bytes)   
Authentication.png (30,534 bytes)   
Authentication.png (30,534 bytes)   
401 Error.png (49,375 bytes)   
401 Error.png (49,375 bytes)   
Bug heat8
Complete LimeSurvey version number (& build)7.1.1
I will donate to the project if issue is resolvedNo
BrowserEdge 150.0.4078.125
Database type & versionMySQL 8.0.32
Server OS (if known)Windows Server 2022
Webserver software & version (if known)IIS 10.0.20348.1
PHP Version8.5.3
Git branch / Pull Request URLhttps://github.com/LimeSurvey/LimeSurvey/pull/5306

Users monitoring this issue

There are no users monitoring this issue.

Activities

c_schmitz

c_schmitz

2026-09-15 16:13

administrator   ~85759

The new React editor authenticates its own REST API calls by sending Authorization: Bearer <token> on every request.
On IIS with Windows Authentication enabled and Anonymous Authentication disabled, IIS intercepts and challenges any request carrying an Authorization header — even one using a scheme (Bearer) it doesn't understand — before it reaches PHP.

Since the main page navigation goes through transparent SSO but the editor's AJAX calls carry this conflicting header, the browser can't silently complete the NTLM/Negotiate handshake and instead pops up a manual credential prompt.
tibor.pacalat

tibor.pacalat

2026-09-16 14:43

administrator   ~85789

@DHSUbk can you test if this patch fixes the issue for you?
DHSUbk

DHSUbk

2026-09-18 08:05

reporter   ~85836

@tibor.pacalat thanks, i can confirm that the patch fixed the issue and I can now open the editor.
c_schmitz

c_schmitz

2026-09-19 22:43

administrator   ~85851

Fix committed to master branch: http://bugs.limesurvey.org/plugin.php?page=Source/view&id=40370
LimeBot

LimeBot

2026-09-21 21:30

administrator   ~85910

Fixed in Release 7.2.0+260921

Related Changesets

LimeSurvey: master da8c15c9

2026-09-18 11:59

c_schmitz

Committer: GitHub


Details Diff		 Fixed issue 20692: Authwebserver issue with new editor and IIS (05306) Affected Issues
20692
mod - application/libraries/Api/Rest/Endpoint/EndpointFactory.php Diff File
mod - application/libraries/Api/Rest/Renderer/RendererBasic.php Diff File
rm - editor/build/static/css/index.0c0f9530.css Diff
mv - editor/build/static/css/index.e23e852d.css → editor/build/static/css/index.331e62a9.css Diff File
rm - editor/build/static/css/index.57194b7d.css Diff
rm - editor/build/static/js/633.9ff99349.js Diff
rm - editor/build/static/js/index.37c5681c.js Diff
rm - editor/build/static/js/index.7bcddd56.js Diff
rm - editor/build/static/js/index.9314aa29.js Diff
rm - editor/build/static/js/index.b3f633a2.js Diff
add - editor/build/static/js/index.ca71e5e8.js Diff File
mod - editor/index.html Diff File
mod - editor/src/hooks/useAuth.js Diff File
mod - editor/src/hooks/useSurvey.js Diff File

Issue History

Date Modified Username Field Change
2026-09-15 12:42 DHSUbk New Issue
2026-09-15 12:42 DHSUbk File Added: Checking permissions.png
2026-09-15 12:42 DHSUbk File Added: Authentication.png
2026-09-15 12:42 DHSUbk File Added: 401 Error.png
2026-09-15 16:13 c_schmitz Note Added: 85759
2026-09-15 16:13 c_schmitz Bug heat 0 => 2
2026-09-15 16:47 c_schmitz Assigned To => c_schmitz
2026-09-15 16:47 c_schmitz Status new => ready for code review
2026-09-15 16:48 c_schmitz Git branch / Pull Request URL => https://github.com/LimeSurvey/LimeSurvey/pull/5306
2026-09-16 14:43 tibor.pacalat Note Added: 85789
2026-09-16 14:43 tibor.pacalat Bug heat 2 => 4
2026-09-18 08:05 DHSUbk Note Added: 85836
2026-09-18 08:05 DHSUbk Bug heat 4 => 6
2026-09-18 12:00 tibor.pacalat Status ready for code review => resolved
2026-09-18 12:00 tibor.pacalat Resolution open => fixed
2026-09-19 22:43 c_schmitz Changeset attached => LimeSurvey master da8c15c9
2026-09-19 22:43 c_schmitz Note Added: 85851
2026-09-21 21:30 LimeBot Note Added: 85910
2026-09-21 21:30 LimeBot Status resolved => closed
2026-09-21 21:30 LimeBot Bug heat 6 => 8