I have an ASP.NET website hosted on IIS 7.5 as below:
I have "customwebsite.com" as the website and in it I have two Web Applications - uk & us - so that I can access these application as customwebsite.com/uk & customwebsite.com/us.
customwebsite.com directory does not have any web.config and have only two folders for web application us and uk.
Both us and uk web application have their individual web.config and have Form Authentication specified as below:
<authentication mode="Forms">
<forms loginUrl="/static/login.aspx" name="login" timeout="20"/>
</authentication>
<authorization>
<deny users="?" />
</authorization>
At this path: /static, there is a web.config with following content:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</configuration>
When I hit the root URL for us application, the Website loads correctly but if I loads from uk, I got the error as below:
I have checked the Folder Security, and all the required users have been granted permission and are same for both us and uk applications.
I have checked the IIS logs and below is the response codes of the request in case of failure: 401 0 0 1519 296
Can someone help me resolving this issue.
Got it resolved.
There was two more folders where the redirection of /static/login.aspx happens.
We need to allow access to all such redirecting folders by having a web.config files in those folders with below content:
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.web>
<authorization>
<allow users="?" />
</authorization>
</system.web>
</configuration>
Ran into this same error, but had a different resolution. In our case we had to set:
<machineKey compatibilityMode="Framework45" />
Details here:
http://ardalis.com/asp-net-shared-authentication-problem-solved
In our case we had an error on the login page that redirected to the an error page that the user did not have rights to see, so it redirected to the login page... cycle rinse repeat.
We removed all the controls from the UI, then added them back one by one until the page crashed. Then we could narrow down the controls that had an error.
And yes, we gave all users access to the error page.
Check below IIS setting
Authorization Rules -must contain only allow user setting not any any other rule ex. deny user rule.
Related
please bear with me: i am pretty new to all of this
i am working on integrating openid connect with a pair of applications developed by the company.
we are using custom/company specific openid connect libraries that are, i think, essentially wrappers around Microsoft.Owin.Security.OpenIdConnect and Owin.Security.OpenIdConnect.Server
in the idP application web.config, we have something like:
<location path="." inheritInChildApplications="false">
<authentication mode="Forms">
<forms loginUrl="~/Login" name="{....}" protection="All" path="/" slidingExpiration="true" requireSSL="false" defaultUrl="~/Home" cookieless="UseCookies" />
</authentication>
<authorization>
<deny users="?" />
<!-- denies anonymous users to all pages, except those defined under location nodes -->
</authorization>
</location>
plus a bunch of location nodes to allow/deny access to specific pages/resources
the problem is that when the openid connect stuff tries to access /.well-known/openid-configuration when the user is not logged in (or, it seems in the process of logging in),
the response is a 302 redirect to the login page
obviously this is causing problems when a JSON response is expected
i have tried adding a location node to the web.config:
<location path= "~/.well-known/openid-configuration">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
(i also tried with path = "~/.well-known")
but i am still getting redirected to the login page
to be clear, there is no actual directory /.well-known in the idP application; the file seems to be constructed somewhere in Owin.Security.OpenIdConnect.Server.
the file seems to be constructed somewhere in Owin.Security.OpenIdConnect.Server
Yes, it is.
Try calling app.UseStageMarker(PipelineStage.Authenticate) immediately after registering the OIDC server middleware to prevent ASP.NET from applying the authorization policies before it has a chance to be invoked:
app.UseOpenIdConnectServer(options => {
options.AllowInsecureHttp = true;
});
app.UseStageMarker(PipelineStage.Authenticate);
Note that you shouldn't need an exception for ~/.well-known/openid-configuration in your web.config when using app.UseStageMarker().
I'm fairly new too but I think you a path to a .aspx page in the location and the rest is inherited.Just change deny to allow users with the asterix. Also make sure the web.config is in the directory. Sounds like you do but in well-known should be the web.config with allow all users.
<?xml version="1.0"?>
<configuration>
<location path="Manage.aspx">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
</configuration>
I have the following structure
login.aspx
reallysecure/homepage.aspx
I'm trying to allow anonymous access to login.aspx and windows authenication to reallysecure/homepage.aspx
My IIS auth is configured to only have anonymous enabled.
Here is my web.config
<?xml version="1.0"?>
<configuration>
<location path="reallysecure">
<system.webServer>
<security>
<authentication>
<windowsAuthentication enabled="true"></windowsAuthentication>
</authentication>
</security>
</system.webServer>
When I navigate to login.aspx everything works as intended. However when I redirect to reallysecure/homepage.aspx i get the following error:
HTTP Error 500.19 - Internal Server Error
The requested page cannot be accessed because the related configuration data for the page is invalid.
81: <authentication>
82: <windowsAuthentication enabled="true"></windowsAuthentication>
83: </authentication>
How do i setup the web.config and IIS to accomplish what i need?
Thanks!
It's a question of authentication vs authorization. Windows authentication should be set at the root level, and should be used for the entire site. But at the root level, you'll specify that anonymous users are allowed, and in "reallysecure" specify that anonymous users are not allowed.
So, instead of the authentication section in the location, set up an authorization section:
<authorization>
<deny users="?"/>
</authorization>
(? == anonymous)
And, at the root level, it should be:
<authorization>
<allow users="*"/>
</authorization>
(* == all users, including anonymous)
In my web application all the .aspx pages resides in Pages directory. The project structure is shown below:
The Home.aspx is set as Start Page and the Web.config file of the Pages folder contains:
<configuration>
<location path="Secured">
<system.web>
<authorization>
<deny users="?"/>
<allow users="*"/>
</authorization>
</system.web>
</location>
</configuration>
And the main Web.config has:
<authentication mode="Forms">
<forms loginUrl="~/Pages/Login.aspx" timeout="2880" defaultUrl="~/Pages/Secured/Home.aspx" />
</authentication>
So when the application launches it redirects to the Login page with the URL:
http://localhost:2453/Pages/Login.aspx?ReturnUrl=%2fPages%2fSecured%2fHome.aspx
Now if I delete the
Login.aspx?ReturnUrl=%2fPages%2fSecured%2fHome.aspx
from that URL and press enter it is taking me to the Directory Listing:
What I want that it will again send me to the Login page located at
http://localhost:2453/Pages/Login.aspx
How can I achieve this? Your help be appreciated.
Thanks.
The localhost:
You need to disable directory browsing from IIS or from the web.config
<configuration>
<location path="Secured">
<system.webServer>
<directoryBrowse enabled="false" />
</system.webServer>
</location>
</configuration>
this entry above applies to IIS 7+, for IIS 6 you'll have to do it from IIS Manager
There are 2 ways using which you can disable the Directory Listing:
This has been tested & works for IIS 10.
1. Web.config
<configuration>
<system.webServer>
<directoryBrowse enabled="false" /> <!--this line will disable directory browsing-->
</system.webServer>
</configuration>
2. IIS
Go to Internet Information Services(IIS) and look for the Directory Browser option. Select it and on the right corner you see an option Open Feature. Click on it and it will take you to another tab. Now select Disable and you see that the browsing has been disabled.
My web config, which is a config file in a folder (a config file additional to the main config file in the virtual directory):
> <?xml version="1.0"?>
<configuration>
<system.web>
<authentication mode="Forms">
<forms name=".MyCookie" loginUrl="~/Registration.aspx" protection="All" timeout="43200" path="/">
<credentials passwordFormat="MD5">
<user name="user" password="ca064d0730abfeb09e383a0e82e65f73"/>
</credentials>
</forms>
</authentication>
<authorization>
<deny users="?"/>
<allow roles="Moderator"/>
<deny users="*"/>
</authorization>
</system.web>
</configuration>
The error that I get:
Error 3 It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS. 5
I am trying to redirect any anonymous users from the administrator and moderator directories.. so I want any anonymous user or users with no role to be redirected to register.aspx..but i dont get it to work because I get that error and I dont know why!! :(
the authentication tag is not permited on subdirectories web.config, unless you define this subdirectory as a full asp.net application, means a diferent aplication than the root - I not suggest it.
so remove this, and keep it to the root web.config only.
<authentication mode="Forms">... </authentication>
You should define your sub directory as location in your web.config.
Check location element. Also check this scenario.
This article explains how to organize your web.configs and location elements.
This is because the section is only supported in IIS
application directories, which doesn't include subdirectories of an
IIS application.
Context:
IIS 6 on Windows 2003 Server
ASP.NET 3.5 sp1
C# Web Application running from a virtual directory
There are a few files that I would like not to serve. For example, there's a hibernate.cfg.xml in the root directory that should not be accessible. There are also log files in a logs directory. On the local development server (Visual Studio 2008) The NHibernate config file can be protected in a couple of ways through Web.config:
<location path="hibernate.cfg.xml">
<system.web>
<authorization>
<deny users="?"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
OR
<httpHandlers>
...
<add path="*.cfg.xml" verb="*" type="System.Web.HttpForbiddenHandler" />
</httpHandlers>
The logs in a different directory can be protected through another Web.config file:
<?xml version="1.0"?>
<configuration>
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</configuration>
None of these work when the application is compiled using aspnet_compiler.exe and deployed to an IIS 6 server. No errors in the logs. The files are readable to anyone. The application is compiled and installed using MSBuild as follows:
<AspNetCompiler Force="true" Debug="true" PhysicalPath="$(DeploymentTempPath)\$(DeploymentAppName)" TargetPath="$(DeploymentPath)\$(DeploymentAppName)" VirtualPath="/$(DeploymentAppName)" />
How do I make IIS 6 respect the authorization rules in Web.config.
Note: assume that I can't move these files outside of the deployment directory.
It looks like IIS does not forward the request for .xml or .txt files to ASP.NET, so it has no chance to apply its authorization controls.
To work around this, I had to do the following (from this forum post):
From IIS Console, open properties of the virtual directory of my app.
Virtual Directory > Configuration
Add new handler for extension ".xml" using the ASP.NET filter (c:\windows\microsoft.net\framework\v2.0.50727\aspnet_isapi.dll in my case)
All verbs. Uncheck both "Script engine" and "Verify that file exists".
Is there any way to do this from within Web.config?
Try this:
<location path="hibernate.cfg.xml">
<system.web>
<authorization>
<deny users="?"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
Static files such as .jpg, .xml and .pdf are by default handled directly by the kernel mode http.sys driver. Unless you've mapped these extensions to ASP.NET they will never hit the ASP.NET pipeline and hence the authorisation mechanism within ASP.NET.
To force static files such as .xml to be processed by .NET on .NET 2.0/3.5/4.0 and IIS6, do the following:
1) Add the entries for.xml (or other file type) to IIS as described above (IIS6 website properties, Home Directory, Configuration)
2) in web.config add the location for the restricted directory or file
<location path="directory_or_file_name">
<system.web>
<authorization>
<deny users="?"/>
</authorization>
</system.web>
</location>
3) Add the following to the httpHandlers section:
<add path="*.xml" verb="*" type="System.Web.StaticFileHandler" validate="true" />
This will force .NET to only serve .xml files as specified in the <location> tag to authenticated users.
URL Authorization: The URLAuthorizationModule class is
responsible for URL authorization on
Windows 2003. This mechanism uses the
URL namespace to store user details
and access roles. The URL
authorization is available for use at
any time. You store authorization
information in a special XML file in a
directory. The file contains tags to
allow or deny access to the directory
for specific users or groups. Unless
specified, the tags also apply to
subdirectories.
You need to do the following:
<deny users="?"/>
<deny users="*"/>
The wild card entry "?" means that no one else will be able to gain access to this directory.