Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a .Net web site with both public and private areas. The private sections are protected with .Net forms authentication. This all works fine. Site runs in IIS integrated mode.

My question is related to my QA/Test site we push changes to prior to going live. I don't want the general public or googlebot to have access to the QA site at all. Not even the portions that would ordinarily not require authentication to access.

The QA site does need to be accessible on the wild internet because we do want folks from other companies, etc. to be able to see and test changes before they go live. So my idea was to put a gatekeeper username/password in front of the entire site. Once people are past that door, they should have access to the "public" areas of the site. Accessing the member area would still require them to go through the forms auth as usual.

I tried turning off anonymous authentication and enabling basic auth, but I get an error about not being able to use 401 challenge based and redirected based auth simultaneously. Unfortunately that is exactly what I want.

I probably could write a custom HttpModule, but I'd rather just do it with standard IIS settings. Anyone have any ideas on how to solve this?

share|improve this question
up vote 1 down vote accepted

IIS 7.x doesn't support both forms auth and windows auth at the same time. Kind of odd, I know.

How about turning on forms auth for the entire site, including public areas? You could give a different login page explaining why they need to sign into everything.

Or, using URL Rewrite, you could have a list of IP addresses that are approved and only allow entry if it's from a valid IP.

share|improve this answer
The IP filtering is a good idea, but I think it'll have too much management overhead. I don't want to have to add new IPs whenever I want to give access to new people. Plus I have cable with dynamic IP. – Craig Quillen Jul 28 '10 at 14:37
Putting forms auth in front of the entire site will probably work. I'd just need to modify the <authorization> section to only allow certain usernames in. I'll try it out. – Craig Quillen Jul 28 '10 at 14:38
I agree that the IP restrictions work in only a smaller amount of cases. They work if you have a small audience that doesn't change much, and have IPs that don't change, or don't change often. Hopefully forms auth does the trick for you. – Scott Forsyth - MVP Jul 28 '10 at 18:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.