0

I've spent the entire day trying to get this to work, though it seems as if it's meant to be an out-of-the-box functionality for IIS7. I just can't figure what I'm goin wrong.

I want to have a web site (say, the default web site, that's fine) configured for forms authentication. By which I mean to say that regardless how many web applications are configured under this web site, any time an anonymous user tries to access a restricted resource they are sent to the same login page, which gathers their credentials and sends them back to the resource they wanted in the first place.

So I've set the authentication on the web site as follows - basically all off, except: anonymous (which I assume needs to be on so that the unsecured stuff is visible without logging in), and forms authentication. I have forms authentication configured to use a login page within a configured application, so: [default web site\auth\login.aspx]

I have an unsecured application configured, which of course is fine.

I have another application which has some unsecured content at its root ([default web site\test\readme.html]), and another directory where I've added a config file that has the <deny users="?"/> (so, [default web site\test\secure\readme.html]) in a config file. Of course my intention is that an anonymous users try to get resources in this directory they will be redirected to the login page for the whole site.

To my surprise, what happens is this - if I turn off anonymous access for the application I want to secure, rather than sending me to the login page configured at the web site level, I just see an unauthorized message in the browser. If I turn anon on for the secured app then no challenge is ever done and everyone can just see all resources without logging in.

Am I missing something here? Shouldn't web applications configured within a web site all act the same way, and use the sites' authentication scheme? Am I wrong about this being a feature or am I just doing something wrong to make it happen?

I also (after goofing with it for a while) set the login page under the 'Error pages' section of the main web site to handle 401 status, without any luck.

1 Answer 1

0

I don't think the asp.net handler is invoked for static files unless you configure it to be. Adding a handlers section for html files in the root config will allow your app using forms authentication to handle html files as well.

  <system.web>
    <compilation>
      <buildProviders>
        <add extension=".html" type="System.Web.Compilation.PageBuildProvider" />
      </buildProviders>
    </compilation>    
 </system.web>

 <system.webServer>
    <handlers>
      <add name="html" verb="GET, HEAD, POST, DEBUG" path="*.html" type="System.Web.UI.PageHandlerFactory" />
    </handlers>
 </system.webServer>
2
  • Two things - it doesn't actually answer my big picture question, which is "Shouldn't web applications configured within a web site all act the same way, and use the sites' authentication scheme?". Also, I made these changes and everything acts exactly the same way, no joy.
    – tntwyckoff
    Jan 13, 2014 at 16:11
  • You refer to your root as a website. Is it a website or configured with a app pool? I assume since you configured forms auth at the root then you have a web config there and converted the web-site to a web application in IIS?
    – Ross Bush
    Jan 13, 2014 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.