I cannot figure out how to see why my IIS server is doing redirects on some pages but not others. I am using forms auth, and in my login page, I need some resources like some .js files, a manifest.json, etc. on the login page (prior to authentication) and some of the resources are not loading becuase it throws a 302 redirect back to the login page for those resources.
I even put some 'hello world' html pages in the root and 1 works fine and the other 2 redirect to the login page.
www.mydomain.com/test.html -- 200 response
www.mydomain.com/test2.html -- 302 response
I turned on logging in IIS and all it shows is a 'get' for test2.html and a 302 but doesn't say why (am I looking in the wrong place?).
I made sure that an 'allow all users' mode is in the .NET Authorization rules for that site and that Anonymous Authentication is enabled (all others are disabled) and an 'Allow all users' authorization rule is there.
In desparation, I even put
<authorization>
<allow users="*" />
<allow users="*" />
</authorization>
in web.config but no help. I have googled around but I can't seem to find anything else to try...
I ended up opening a case with Microsoft on this; turns out that I had 'Specific User' selected as my Anonymous user identity and that was set to the default user of 'IUSR', so for un-authenticated users, it was using that user which did not have the proper file level permissions. I set it to 'Application Pool Identity' and all is well.
in IIS manager, select the application, then click "Authentication", then edit the 'Anonymous Authentication' node and change it to 'Application Pool Identity'.
Related
This is a small thing but it is driving me crazy and I am hoping that an IIS expert can help.
The scenario is simple:
IIS is configured so that "default.aspx" is the default document for
a site.
Forms authentication is on and the loginUrl is default.aspx
and defaultURL is default.aspx
In web.config, the default.aspx document has an authorization of ' * ' (anyone can access)
When I navigate to the site with just the base url: www.somesite.com the URL comes back with: www.somesite.com/default.aspx?ReturnUrl=%2f
If I navigate to the full name (www.somesite.com/default.aspx) it does not have the ReturnUrl. So, why, when IIS adds the name, do we get the weird redirect but not when we type it?
You need to add <allow users="?" /> to allow non-logged-in users too.
The issue is I can't view the page using Window Authentication.
This is my steps.
I created a website in my server Windows Server 2003 IIS 6 with .Net Framework 2.
Then Inside the root folder, I created a folder. Let's call it "FolderA".
In "FolderA", I created a page. Let's call it "fileA.aspx".
The website is running fine. As I turn on the Anonymous Access.
But for "fileA.aspx", I need to turn on the Window Authentication coz I don't want everyone to go in and view that page.
So, I select "FolderA", go to Properties,
So, I turn off the Anonymous Access and make sure Window Authentication is turned on.
Then I browse from my PC. It prompted me the Login Diaglog Box.
I key in my credentials I used to log in for the server and I can access the page.
That is working fine.
However, when I view it from the server itself, it prompted me the Login Diaglog Box.
But when I key in my credentials, it is saying "Access Denied".
I even tried using Administrator credentials.
It is still access denied.
Is there any setting to set or anything to change in web.config?
http://support.microsoft.com/kb/896861
Review event logs on the server to see if you happen to hit this.
Did you allow authenticated users and deny not authenticated users?
<authorization>
<allow users="*"/>
<deny users="?"/>
</authorization>
Firstly I just want to say I'm not an ASP developer, I'm PHP through n through...
So my problem is this, all of a sudden a client site has started prompting for users to be logged in when viewing pages in a sub directory, when I download the web.config file I can see the authentication mode set to "Windows" this would appear to be an issue but it was working up until now, so I set it to None and uploaded the file (there isn't a web.config in the sub directory, just the site root) and it continues to prompt me for the login.
Is there something I need to do to "refresh" the server or something? I've looked through the hosting control panel and can't find anything about anonymous access or restarting the server, its on a shared hosting account and the control panel is pretty below average
Any help is greatly appreciated!! I'm in a panic and the hosting company don't have ASP support on hand
Thanks,
Mark
In the folder that you want anonymous access, just use the web.config authorization section to allow anonymous users:
<configuration>
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</configuration>
The * essentially means Everyone so it just saying that for the current directory, everyone is allowed access- you only need this in the web.config...nothing more.
If you are still receiving prompts after this, then the folder itself must have permissions at the operating centre level (NTFS permissions) which do not allow Anonymous access...Although you say the ASP support isn't at hand, I presume you can raise help tickets with them to enable this access?
Edit
I should add that this setting of authorization is different to setting an Authentication scheme (Windows Authentication, Forms Authentication etc). For example, you might have Forms Authentication for your website but specifically want anonymous access to a folder (like this case) so setting your authentication option isn't actually relevant.
I have a webpage that emits files (images) (through Response.TransmitFile) that is working ok.
However, when I publish the site to IIS (5.1), it starts randomly to emit 401 and 403 status codes instead of the expected files(images)
The IIS site is supposed to have Windows Integrated Authentication without allowing anonymous users, however, I configured the locations on my web.config to allow users to get the files
<location path="ViewFile.aspx">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
I have set permissions for The users \IUSR_, \ASPNET, My own domain user, and even for everyone, but i don't get to solve the problem.
Any suggestions at how can I handle the problem?
Edit 1:
When I activate anonymous authentication in IIS, the site works fine, but then the domain authentication doesn't appear. I understand that the anonymous authentication prevails over anyother authentication
Some points to get you started:
What do you see in the Windows Event
log?
If you take out the authorization
configuration, does it work OK -- or
do you still get 401 and 403 codes?
You mentioned that it happens
'randomly' -- is it connected with
certain users? Or times of heavier
load? Or certain files?
TransmitFile doesn't buffer in memory
-- are these large files?
Update 6/29/2011 5:02pm - You didn't mention you were publishing locally before. Have you tried this configuration hack? I have had to use it when using Windows Authentication and IIS locally.
I have an asp.net (dynamic data) website set up as an application in a subdirectory of another site. This site requires different security settings from the top level site. Something like:
<authorization>
<allow roles="ADMIN"/>
<deny users="*"/>
</authorization>
These settings are ignored in the sub site. However, they work on the top level site, but even when set on the top level site, they are not inherited by the sub-site, and it's freely accessible. What could cause these settings to be ignored? I've tried adding:
<location path="." inheritInChildApplications="false">
to the top level web.config and then setting the above authorization rule in the sub site, even tried just denying all users. When visiting the site it looks like: http://mysite/mybrokensite
I am using windows authentication.
I think the key thing is this
website set up as an application in a
subdirectory of another site
If it's a separate application within IIS it should have it's own web.config file and the security settings can be set from there. So you'll have one web.config for the main site and one for the subsite. really they are two applications.
If it's just a subfolder under your website then this doesn't apply. It depends how you've set it up under IIS. If it's a seperate app then the icon will be a world/cabbage type icon. If it's a sub-folder they the icon will be ... well a folder.
To elaborate on Tim's answer, make sure in IIS that it is set up as a virtual directory. Look at the property page for that directory in IIS Admin, Directory (or Home Directory) tab. If the Application label is greyed out, hit the Create button. Now IIS will load the web.config from that directory.
I typed up a summary since many were facing the same situation regarding subfolder authentication.
Subfolder Authorization
ASP.NET can only have a single
authentication mode for one
application.
The different
applications CANNOT share resource
among them.
Scenario
Let's say the home page should not prompt login dialog. It should let users pass through without whatever login is. However, in the same applicatiopn, in a different folder presumably, another page needs to check user permission against database table using user network login ID. By default IE treats all web site with only hostname a Intranet. By its default intranet setting, it will not prompt the login dialog and pass user login and password to the application if Windows Authentication is used. However, the tricky party is, if the application has an actual domain, IE will think it is an Internet site, and it will prompt the login and password if Windows Authentication is used.
The only way to not to promopt login dialog for Internet site using Windows Authentication, is to also turn on the anonymous authentication in IIS. However, you will lose the ability to capture the login info because the Anonymous has precedence over the Windows Authentication. The good news is there is a way to resolve that issue. If an application subfolder needs to capture the login information, you will need to overwrite the parent authorization in Location element in web.config.
1 In IIS, configure Authentication as follows:
Enable Anonymous Authentication,
Enable Windows Authentication
2 Add the followings in Web.Config.
<authentication mode="Windows" />
<authorization>
<allow users="*" />
</authorization>
<!-- secured is the relative subfolder name. deny anonymous user, so only the authenticated login will pass through -->
<location path="secured" allowOverride="true">
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>