Strange Windows IIS Authentication Behavior

Question

I have an ASP.NET 3.5 web service (the old school SOAP, not WCF), running on two servers configured identically in IIS 6.0. Authentication / access control is configured as follows:

• Enable Anonymous Access = False
• Integrated Windows Authentication = True
• Digest Authentication for Windows Domain Servers = False
• Basic Authentication = False
• .NET Authentication Passport = False

In one of the web methods, I need to get the identifier of the requesting user and check it in a specific Active Directory group. So, the first line of code in the web method is this:

var requestUser = HttpContext.Current.Request.LogonUserIdentity.Name; 

For some reason, the results differ between the two servers. Server1 works as expected, creating domain\UserId . However, Server2 creates Server2\IUSR_SERVER2 . Has anyone experienced this before? I found this question , but I'm sure it does not apply here, as the client and both servers are in the same domain.

Additional Information

Based on Heinzi's answer, I added the following to the <system.web> section in the web.config files:

 <authorization> <deny users="?" /> <allow users="*" /> </authorization> 

Now Server1 behaves the same as in, it behaves the way I want it. However, Server2 throws 401.2: Unauthorized error:

Server error in application "/".

Access is denied. Description: An error occurred while accessing the resources needed to service this request. The server may not be configured to access the requested URL.

Error message 401.2 .: Unauthorized. Login failed due to server configuration. Make sure that you have permission to view this directory or page based on the credentials you provided and the authentication methods included on the web server. Contact your web server administrator for further assistance.

Version Information: Microsoft.NET Framework Version: 2.0.50727.3603; ASP.NET Version: 2.0.50727.3053

Answer 1

Unfortunately, I never got to the root of this problem. We moved to new servers and with a fresh IIS configuration for both, this problem disappeared. I suspect that it may have had something to do with how the network adapters were configured on the server, as it was a virtual server with several network adapters. But I still don’t know for sure. Thanks again to Heinzi and consultutah for their help.

Answer 2

I was creating a new MVC 4 ASP.NET web application and faced the same error as you (error 401.2) when I first tried to create my project.

I changed the settings in IIS Manager on my development machine to disable anonymous authentication and enable Windows authentication, but I was still getting error 401.2.

I did a little research and found out that I can change the properties of my project and solve this error.

Solution Browser:

• Choose a project
• Press F4 to display the properties window.

Properties Window:

• Change Anonymous Authentication to Disabled
• Change Windows Authentication to Enabled

I hope this helps other people if this does not solve your specific problem. As long as you have the same settings on your web server, it should work as intended.

Answer 3

In web.config on Server2, do you have: authentication mode = "Windows"?

Answer 4

Since IUSR_* is the default anonymous user and anonymous access is disabled in IIS, it seems that anonymous access is enabled in your web.config. Make sure the authorization section in your web.config looks something like this:

 <authorization> <deny users="?" /> <!-- Reject anonymous users --> <allow users="*" /> <!-- Accept all other users (or replace * with a list of users) --> </authorization> 

Answer 5

I had the same problem with IIS7 on a virtual server, my login was directed to a folder called "content". In my web configuration, there was a “location” section containing Forms authentication settings. However, I configured it for Windows authentication, so when IIS got into my content folder, it did not know which authentication to use, so it returned an error. After removing from the configuration, it worked fine:

 <location path="content"> <system.web> <authorization> <deny users="?" /> <allow users="*" /> </authorization> </system.web> </location> 

thanks