Title	AxM 4.9 Agent for IIS does not serve read only copies of Microsoft Office Documents

URL Name	a57990-AxM-4-9-Agent-for-IIS-does-not-serve-read-only-copies-of-Microsoft-Office-Documents

Summary

Validation Status	Work in Progress

Age	4,379.33

Translate To

Applies To

RSA Access Manager 4.9.1 Agent for IIS 7.x
SharePoint is not installed on the backend server, and Office documents are being opened in read only mode.

Issue

AxM 4.9 Agent for IIS does not serve read only copies of Microsoft Office Documents
When attempting to open an Office document (for example, an MSWord doc), the user is presented with a second forms based logon page in the Word application. If the user attempts to authenticate in this window, the logon loops.

Cause

There was a change made to the 4.9 Agent to support SharePoint integration with Office applications. In current versions of Office, the Office application will initiate a dialog with the back end web server to determine what kind of read and write access to documents is in use. This negotiation uses the OPTIONS verb to exchange details. The 4.9 agent now detects this negotiation, and changes the logon process for Office documents. This requirement satisfies SharePoint support, but is not needed if SharePoint is not installed on IIS (and only read only access to Office documents is required).

Resolution

The following work around may be used if the hotfix cannot be applied. If support is not required for SharePoint, disable the support for the OPTIONS verb in IIS 7.x. This can be done in several ways and is dependent on the version of IIS if you have applied the administration pack. If the administration pack is enabled, you can disable the OPTIONS verb by creating a deny rule in the IIS management console under "Request Filtering" for the "HTTP Verb" called OPTIONS.

The same thing can be accomplished by executing the following applications management command for the virtual host where the content is being served from:

C:\Windows\System32\inetsrv>appcmd.exe set config /section:requestfiltering /+verbs.verb='OPTIONS',allowed='false']

This disables the dialog between Microsoft Word, and IIS will negotiate for SharePoint access.

This issue is resolved in hotfix 4.9.1.13 for the RSA Access Manager 4.9.1 Agent for IIS 7.x. Contact RSA Customer Support and request this hotfix or the latest cumulative hotfix for you platform. This hotfix introduces a new webagent.conf file parameter that may be used to disable the sharepoint support.

Set the value to false:

# A Boolean parameter to enable support for client based integration with

# Microsoft office documents hosted on SharePoint Server. If enabled, agent

# would prompt for authentication in a new office client window and provide

# access to the document after successful authentication.

#

# This parameter should be enabled only for sites where client based

# integration with office documents needs to be supported.

#

# Allowed Values:

# True

# False

#

# Default Value:

# False

cleartrust.agent.enable_msoffice_client_integration=False

Workaround

Notes

For more information on the OPTIONS verb in IIS, see the following article:

http://www.iis.net/ConfigReference/system.webServer/security/requestFiltering/verbs

Legacy Article ID 000016365

Audience	External

Article Source	Conversion

Original Article Author	istaines

Original Created Date	4/23/2012 5:34 PM

Owner	Admin6 Integration (R3 Propel)

Assigned To

Assigned By

Assignment Note

Assignment Due Date

Publication Status	Published

Article Type	Knowledge

Article Number	000049425

Created By	Admin6 Integration (R3 Propel)

Last Modified By	Katrina Nash

Language	English