3

Is it possible to disable windows authentication on one or more subfolders of an ASP.net application using windows authentication?

For example:

A website contains several other folders that contain parts of the overall application: /frontend, /backend, /login

The bin folder is on the same level as these subfolder, i.e. the root of the website.

All of these subfolders contain pages that use binaries that reside in the bin folder of the root of the website.

The user must input windows credentials when visiting a page in the backend folder, but not when visiting a page in the login or frontend folder.

I'm using IIS7

Any ideas?

2 Answers 2

8

Found a solution:

  • Adjusted the applicationHost.config file and changed the "overrideModeDefault" to "Allow" for the anonymousAuthentication en windowsAuthentication section entries

       <section name="anonymousAuthentication" overrideModeDefault="Allow" />
       <section name="windowsAuthentication" overrideModeDefault="Allow" />
    
  • Added location tags in the web.config for every folder / file that needed to be excluded from windows authentication

       <location path="pathToDirOrFile">
         <system.webServer>
           <security>
            <authentication>
             <anonymousAuthentication enabled="true" />
             <windowsAuthentication enabled="false" />
            </authentication>
           </security>
          </system.webServer>
       </location>
    
  • Made sure each one of those folders contained a separate web.config file that disables identity impersonation

       <configuration>
        <system.web>
         <identity impersonate="false" />
        </system.web>
       </configuration>
    
1

You can control authentication using the location tag in the web.config, or, put another web.config in to the relevant subfolder specifying the settings you need applying.

You can also control access to resources (folders or individual files) within IIS hence you'll need to make sure you don't have conflicting rules in place.

2
  • I've tried adding location tags to the web.config and using seperate web.config files), but both do no seem to work. <location path="login"> <system.web> <authorization> <allow users="*" /> </authorization> <identity impersonate="false" /> </system.web> </location>
    – Bert Vandamme
    Apr 27, 2010 at 14:45
  • Thx for your help, found a solution using location tags
    – Bert Vandamme
    Apr 28, 2010 at 9:20

You must log in to answer this question.