HTTP 400 Error when opening custom reports from a remote computer when using Kerberos Authentication. (4306715)

Chat now with support

Return

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title

HTTP 400 Error when opening custom reports from a remote computer when using Kerberos Authentication.
Description

You receive an HTTP 400 - Bad Request or HTTP 400 - Bad Request (Request Header too long) when accessing custom reports through IE 6 or higher on a remote machine while authenticating through Kerberos.
Cause

IIS sends a Bad Request error to the browser because the Kerberos token that the was sent to it by the browser is too large, causing the kerberos authentication to fail. Microsoft suggests this is due to the Privilege Attribute Certificate field on the Kerberos packet which carries AD group membership data.
Resolution

Resolition 1:
Set the MaxTokenSize to 65535 in every remote station you wish to see the reports from with any account with the required membership

Start Registry Editor (Regedt32.exe).
Locate and click the following registry setting:
System\CurrentControlSet\Control\Lsa\Kerberos\Parameters
On the Edit menu, click Add Value, and then add the following registry value:
Value name: MaxTokenSize
Data type: REG_DWORD
Radix: Decimal
Value data: 65535
Quit Registry Editor.

Resolution 2:
Create an account with the minimal required membership to view the reports in order to reduce the size of the token.
Additional Information

http://support.microsoft.com/kb/327825

Feedback Submitted

Did this article solve an issue for you?

Select Rating

Title