Access denied logging in as different user

Question

Our ASP.NET application pages are deployed as a feature into a MOSS 2007 farm.

When a user logs on to the site the user is directed to a default page.

In the top right corner there is an option "Log on as a different user". If the user selects this option and enters the credentials of another user, an "Access Denied" message is displayed.

This message does not make sense since all the users have access to this default page. Furthermore, if the user now goes to the address bar and manually changes the URL to the default page, the page loads. I can see in the source part of the "Access Denied" URL that the encoded URL of the target page is the expected default page URL.

Previously, I made a change to the INIT.JS file to redirect the user in the case where the login change is done from a page that is not the default page.

function LoginAsAnother(url, bUseSource)
{
    document.cookie="loginAsDifferentAttemptCount=0";
    if (bUseSource=="1")
    {
     GoToPage(url);
    }
    else
    {
     var ch=url.indexOf("?") >=0 ? "&" : "?";
     //url+=ch+"Source="+escapeProperly(window.location.href);
     url+=ch+"Source="+escapeProperly(getSspLocation(window.location.href));
     STSNavigate(url);
    }
}

The original line is commented out.

The function getSspLocation is just a function I wrote to get the default page URL from any other URL.

function getSspLocation(url) {
    var parts = url.split('/');
    var result = "";
    for (var i = 0; i < parts.length; ++i) {
     result += parts[i] + "/";
     if (parts[i].toLowerCase() == "ssp")
      return result + "default.aspx";
    }
    return url;
}

Any ideas?

Answer 1

This will not answer your question, but I would advice you against modifying the init.js file. It is both against good practice and against Microsoft's recommendation, you will lose support from them. Furthermore, it will most certainly be overwritten when applying service packs and/or hot fixes.

If you have the need to customize the functionality of OOB script files, do so by deploying a custom master page that incorporates your custom scripts instead.