Unable to Download an Office file from a Web Server Published through ISA Server 2006

[LEFT][CODE]http://blogs.technet.com/isablog/archive/2009/11/21/unable-to-download-an-office-file-from-a-web-server-published-through-isa-server-2006.aspx[/CODE]

[B][FONT=Calibri]1. Introduction[/FONT][/B]
[FONT=Times New Roman] [/FONT]
[FONT=Calibri]Consider a scenario where ISA Server 2006 is configured to publish a simple web site using HTTPS and within this site there is a link to download a Microsoft Word file. When external users try to download the file they receive the initial window with open or save file options as shown below:[/FONT]
[FONT=Calibri][/FONT]
[FONT=Calibri][IMG]http://blogs.technet.com/photos/repository_ii_for_isa_blog_figures/images/3295512/original.aspx[/IMG] [/FONT]
[FONT=Calibri][/FONT]
[FONT=Calibri] [FONT=Calibri]After clicking [I]Save[/I] the following error message appears:[/FONT]

[IMG]http://blogs.technet.com/photos/repository_ii_for_isa_blog_figures/images/3295513/original.aspx[/IMG]

[FONT=Calibri]The web server was listening on HTTP and an internal user connecting to the web server directly over HTTP was able to download this file. . This problem was happening on all versions of Internet Explorer regardless of the client OS platform (Windows XP, Vista and Windows 7).[/FONT]
[FONT=Calibri] [/FONT]
[B][FONT=Calibri]2. Gathering more Data[/FONT][/B]
[FONT=Times New Roman][SIZE=2] [/SIZE][/FONT]
[FONT=Calibri]The rule worked for the most part, only this specific condition (downloading office documents) was failing. From an ISA Server perspective, it’s always good in cases like these to get an [/FONT][URL="http://blogs.technet.com/yuridiogenes/archive/2009/05/07/using-isabpa-for-proactive-and-reactive-work-with-isa-server-part-2-of-2.aspx"][FONT=Calibri]ISA Data Packager in repro mode[/FONT][/URL][FONT=Calibri] using Web Proxy and Web Publishing scenario. In this case it was also important to get a Network Monitor trace from the client workstation and IIS logs from the web server. This way we had the entire communication chain.[/FONT]
[FONT=Calibri] [/FONT]
[B][FONT=Calibri]3. Analyzing[/FONT][/B]
[FONT=Times New Roman][SIZE=2] [/SIZE][/FONT]
[FONT=Calibri]From an ISA Server perspective there were no errors in traces and live logging was also clear as shown below:[/FONT]

[IMG]http://blogs.technet.com/photos/repository_ii_for_isa_blog_figures/images/3295514/original.aspx[/IMG]
[/FONT] [FONT=Calibri] [/FONT]
[FONT=Calibri] [FONT=Calibri]The Web Server logs also appear clear and according to netmon traces the content was transferred from the Web Server to the ISA Server:[/FONT]
[FONT=Calibri] [/FONT]
[FONT=Calibri]ISA Server sends the GET request to the file:[/FONT]
[CODE][FONT=Calibri] [FONT=Courier New][SIZE=2]10.20.20.2 10.20.20.25 HTTP HTTP:Request, GET /mydoc.asp[/SIZE][/FONT]

[/FONT][/CODE]
[FONT=Calibri] [/FONT]
[FONT=Calibri]Web Server answers the request with the file:[/FONT]
[CODE]
[FONT=Courier New][SIZE=2]10.20.20.25 10.20.20.2 HTTP HTTP:Response, HTTP/1.1, Status Code = 200, URL: /mydoc.asp[/SIZE][/FONT]
[FONT=Courier New][SIZE=2]- Http: Response, HTTP/1.1, Status Code = 200, URL: /mydoc.asp [/SIZE][/FONT]
[FONT=Courier New][SIZE=2] ProtocolVersion: HTTP/1.1[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] StatusCode: 200, Ok[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] Reason: OK[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] Date: Fri, 20 Nov 2009 21:20:28 GMT[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] Server: Microsoft-IIS/6.0[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] XPoweredBy: ASP.NET[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] Cache-control: no-cache[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] ContentLength: 38021[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] + ContentType: application/msword[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] Cache-control: private[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] HeaderEnd: CRLF[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] - payload: HttpContentType = application/msword[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] HTTPPayloadLine: [/SIZE][/FONT]
[FONT=Courier New][SIZE=2] HTTPPayloadLine:[/SIZE][/FONT]
[/CODE][FONT=Courier New][SIZE=2] [/SIZE][/FONT]

[FONT=Calibri] [/FONT]
[FONT=Calibri]IIS Logs from the Web Server also shows that the content was correctly answered:[/FONT]
[CODE]
[FONT=Calibri][FONT=Courier New][SIZE=2]2009-11-20 21:20:28 W3SVC1 10.20.20.25 GET /mydoc.asp - 82 - 10.20.20.2 Mozilla/4.0+(compatible;+MSIE+7.0;+Windows+NT+5.1;+.NET+CLR+2.0.50727) 200 0 0[/SIZE][/FONT][/FONT]
[/CODE]

[FONT=Calibri] [/FONT]
[FONT=Calibri]At this point we know that client sends the request, ISA correctly sends the request back to the web server which correctly provides the content to ISA. On the client side, Netmon just showed the encrypted conversation. In order to see what was really happening on the client side, we used HTTP Watch and there we could see that the actual content was already local as you can see in the figure below:[/FONT]
[FONT=Calibri][/FONT]
[FONT=Calibri][IMG]http://blogs.technet.com/photos/repository_ii_for_isa_blog_figures/images/3295515/original.aspx[/IMG] [/FONT]

[B][FONT=Calibri]4. Resolution[/FONT][/B]
[FONT=Times New Roman][SIZE=2] [/SIZE][/FONT]
[FONT=Calibri]The problem was related to the following header in the response from the web server:[/FONT]
[FONT=Calibri] [/FONT]
[CODE]
[FONT=Courier New][SIZE=2]10.20.20.25 10.20.20.2 HTTP HTTP:Response, HTTP/1.1, Status Code = 200, URL: /mydoc.asp[/SIZE][/FONT]
[FONT=Courier New][SIZE=2]- Http: Response, HTTP/1.1, Status Code = 200, URL: /mydoc.asp [/SIZE][/FONT]
[FONT=Courier New][SIZE=2] ProtocolVersion: HTTP/1.1[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] StatusCode: 200, Ok[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] Reason: OK[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] Date: Fri, 20 Nov 2009 21:20:28 GMT[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] Server: Microsoft-IIS/6.0[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] XPoweredBy: ASP.NET[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] Cache-control: no-cache[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] ContentLength: 38021[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] + ContentType: application/msword[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] Cache-control: private[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] HeaderEnd: CRLF[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] - payload: HttpContentType = application/msword[/SIZE][/FONT]
[FONT=Courier New][SIZE=2] HTTPPayloadLine: [/SIZE][/FONT]
[FONT=Courier New][SIZE=2] HTTPPayloadLine:[/SIZE][/FONT]
[/CODE][FONT=Courier New][SIZE=2] [/SIZE][/FONT]

[FONT=Calibri] [/FONT]
[FONT=Calibri]Here it is the explanation why it was failing:[/FONT]
[FONT=Calibri] [/FONT]
[I][FONT=Calibri]“In order for Internet Explorer to open documents in Office (or any out-of-process, ActiveX document server), Internet Explorer must save the file to the local cache directory and ask the associated application to load the file by using IPersistFile::Load. If the file is not stored to disk, this operation fails. [/FONT][/I]
[I][FONT=Calibri]When Internet Explorer communicates with a secure Web site through SSL, Internet Explorer enforces any no-cache request. If the header or headers are present, Internet Explorer does not cache the file. Consequently, Office cannot open the file.”[/FONT][/I]
[FONT=Calibri]From [/FONT][URL="http://support.microsoft.com/kb/316431"][FONT=Calibri]http://support.microsoft.com/kb/316431[/FONT][/URL][FONT=Calibri][/FONT]
[FONT=Calibri] [/FONT]
[FONT=Calibri]Although this article says it applies to IE 5 and IE6, this issue happened on IE7 and IE8. This is an expected behavior and in order to fix this you will need to follow the recommendation from [/FONT][URL="http://support.microsoft.com/kb/316431"][FONT=Calibri]KB316431[/FONT][/URL][FONT=Calibri]. The reason why it was working internally for all users is because internally the access to this web server was using HTTP and this problem just happens when using SSL. Once more ISA was not guilty , it was only doing what the web server was asking it to do.[/FONT]
[FONT=Calibri] [/FONT]
[B][U][FONT=Calibri]Author[/FONT][/U][/B]
[FONT=Calibri]Yuri Diogenes[/FONT]
[FONT=Calibri]Sr. Security Support Escalation Engineer [/FONT]
[FONT=Calibri]Microsoft CSS Forefront Edge Team[/FONT]
[FONT=Times New Roman] [/FONT]
[B][U][FONT=Calibri]Technical Reviewer[/FONT][/U][/B]
[FONT=Calibri]Mohit Kumar[/FONT]
[FONT=Calibri]Sr. Security Support Escalation Engineer [/FONT]
[FONT=Calibri]Microsoft CSS Forefront Edge Team[/FONT]
[/FONT]
[/LEFT]