Geek Answers Handbook

IIS7 / Config Authorization Rules - Permanent Maintenance

I am trying to protect an application in IIS7 using .NET authorization rules.

By default, the web server allows all users access (which is inherited).

I added, for this single application directory only, the deny all users command, as well as the allow command for specific users.

<?xml version="1.0" encoding="UTF-8"?> <configuration> <system.web> <authorization> <allow users="myusername" /> <deny users="*" /> </authorization> </system.web> </configuration>

I have Windows authentication turned on and I can verify that without the string my REMOTE_USER is MYDOMAIN \ myusername.

However, when I try to refuse all users, I am offered a typical username / password window for a Windows domain. If I enter the user password, the invitation is returned again 3 times until finally it gives me an error message. (I also tried to no avail)

If you look in the event viewer, it seems to me that my login using the username and pw passed the audit successfully ... and, in the future, my account is not blocked (what would happen if I were not able to login again and again). So it’s as if I’m logging in, but the configuration does not display what I entered as a match for my registration.

Below is the message that I see (even when connecting from the server using localhost):

** Access is denied.

Description. An error occurred while accessing the resources needed to service this request. The server may not be configured to access the requested URL.

Error message 401.2 .: Unauthorized. Login failed due to server configuration. Make sure that you have permission to view this directory or page based on the credentials you provided and the authentication methods included on the web server. Contact your web server administrator for further assistance. **

+6
iis iis-7
source share
4 answers

First of all, the main problem was that IIS6 Authorization is also included in IIS7, and at least in my case it was by default. First, make sure you have IIS7 authorization installed. The complete guide can be found here:

http://www.iis.net/ConfigReference/system.webServer/security/authorization

The confusion arises because IIS7 has an element in your application called the .NET Authorization Rules (in the ASP.NET section). This is NOT what you want for IIS7 authorization. To do this, you need to make sure that it is installed (see the Link above), and then click the link in the IIS section of your application called "Authorization Rules"

Another note worth mentioning if you install the following configuration:

 <configuration> <system.webServer> <security> <authorization> <remove users="*" roles="" verbs="" /> <add accessType="Deny" users="unknownname" /> <add accessType="Allow" users="knownname" /> </authorization> </security> </system.webServer> </configuration>

It will make everyone refuse. It appears that if you renounce a username or role that does not exist, EVERYONE is rejected. If the recognized user is recognized, then it works great.

In addition, specifying deny for * and permission for certain users will not work, it will deny for everyone. You just need to remove the user * (as in my example above) and then allow only your target audience. By default, everyone is denied.

+7
source share

Could you please change your code below

 <deny users="*" /> <allow users="myusername" />
0
source share

I spent 4 hours trying to fix this (to use the domain role) :). The final solution was also to use the domain name in this role:

 `<system.web> <authorization> <allow roles="DOMAINNAME\rolename" /> <deny users="*" /> </authorization> </system.web>`
0
source share

More articles:


All Articles