web site configuration

asp.net authorization asp.net-4.0
Budda picture Budda · May 17, 2011 · Viewed 67.5k times · Source

One web site is required to be accessed by me (developer) and one user (DOMAIN_NAME\USER_NAME).

When I developed web site in visual studio using "automatic host" created by VS, the following settings in web.config were enough:

<authentication mode="Windows"/>
<authorization>
  <allow users="DOMAIN_NAME\my_name,DOMAIN_NAME\USER_NAME" />
  <deny users="*" />
</authorization>

But when I created web site in IIS I'm receiving error:

Access is denied.

Description: An error occurred while accessing the resources required to serve this request. The server may not be configured for access to the requested URL.

Error message 401.2.: Unauthorized: Logon failed due to server configuration. Verify that you have permission to view this directory or page based on the credentials you supplied and the authentication methods enabled on the Web server. Contact the Web server's administrator for additional assistance.

What setting for ApplicationPoolIdentity and web site itself are required to be specified?

Thanks a lot!

EDIT:

I've configured Application Pool of local IIS to use 'LocalSystem' identity, web site - to use "pass-through" authentication, and as suggested disabled "Anonymous Authentication", enabled "Windows Authentication" - and web site locally became workable.

But locally I have windows 7 (IIS7), but on "TEST" environment (where I need to deploy web site) I have windows 2008 server and it doesn't have option to enable "Windows Authentication"... don't know why... probably that is for higher level of administrator, but I'm a member of Administrators group...

Guess, I'm doing something wrong...

Please advise.

Answer

p.campbell picture p.campbell · May 17, 2011

Your web.config is set up properly. Further, ensure the IIS site/app is configured as:

  • to NOT allow anonymous access
  • forcing Integrated Windows authentication
  • leave the app pool as Network Service

IIS7

IIS6

Find the dialog below at

  • Control Panel / Administrative Tools -> IIS Manager -> Right click Web site -> Properties -> Directory Security

IIS 6 non anonymous with Windows Authentication

Related questions

How do you create a custom AuthorizeAttribute in ASP.NET Core?

I'm trying to make a custom authorization attribute in ASP.NET Core. In previous versions it was possible to override bool AuthorizeCore(HttpContextBase httpContext). But this no longer exists in AuthorizeAttribute. What is the current approach to make a custom …

Read More
Why is <deny users="?" /> included in the following example?

The ? wildcard represents unauthenticated users while * represents all users, authenticated and unauthenticated. My book shows the following example of URL authorization: <authorization> <deny users="?" /> <allow users="dan,matthew" /> <deny users="*" /> </authorization&…

Read More
How to get user name using Windows authentication in asp.net?

I want to get user name using Windows authentication Actually I implemented "Sign in as different user",when click this button Windows security will appear there we can give credentials. In that time if I give some other credential it …

Read More