1

I have a .Net web site with both public and private areas. The private sections are protected with .Net forms authentication. This all works fine. Site runs in IIS integrated mode.

My question is related to my QA/Test site we push changes to prior to going live. I don't want the general public or googlebot to have access to the QA site at all. Not even the portions that would ordinarily not require authentication to access.

The QA site does need to be accessible on the wild internet because we do want folks from other companies, etc. to be able to see and test changes before they go live. So my idea was to put a gatekeeper username/password in front of the entire site. Once people are past that door, they should have access to the "public" areas of the site. Accessing the member area would still require them to go through the forms auth as usual.

I tried turning off anonymous authentication and enabling basic auth, but I get an error about not being able to use 401 challenge based and redirected based auth simultaneously. Unfortunately that is exactly what I want.

I probably could write a custom HttpModule, but I'd rather just do it with standard IIS settings. Anyone have any ideas on how to solve this?

1 Answer 1

1

IIS 7.x doesn't support both forms auth and windows auth at the same time. Kind of odd, I know.

How about turning on forms auth for the entire site, including public areas? You could give a different login page explaining why they need to sign into everything.

Or, using URL Rewrite, you could have a list of IP addresses that are approved and only allow entry if it's from a valid IP.

3
  • The IP filtering is a good idea, but I think it'll have too much management overhead. I don't want to have to add new IPs whenever I want to give access to new people. Plus I have cable with dynamic IP. Jul 28, 2010 at 14:37
  • Putting forms auth in front of the entire site will probably work. I'd just need to modify the <authorization> section to only allow certain usernames in. I'll try it out. Jul 28, 2010 at 14:38
  • I agree that the IP restrictions work in only a smaller amount of cases. They work if you have a small audience that doesn't change much, and have IPs that don't change, or don't change often. Hopefully forms auth does the trick for you. Jul 28, 2010 at 18:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .