Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a sub-directory of my IIS7 website that I want to lock-down with basic authentication. I've gone into IIS manager, chosen Authentication the designated directory and enabled Basic Authentication and disabled all other kinds. When I browse to the directory from the server, I get the username/password prompt. When I use a browser on a remote machine, however, I don't get the username/password prompt.

I've used Fiddler to look at the HTTP traffic, and the WWW-Authenticates header is not getting sent to the remote browser.

I've searched and searched through the configuration and can't find any setting that would be causing this. What is stopping the prompt from appearing?

We've tried turning off all other sites on that server to ensure the correct website is being hit. After viewing the HTTP log, I can see our request come in: it results in a 500 error from our application (because the user isn't logged in). This leads me to believe the web server is not properly challenging the browser because our application code is executing.

share|improve this question
add comment

1 Answer

Do you mean that it works without prompting them (i.e. it's not asking for authentication), or does it fail and throw an error of some sort?

One thing worth testing is what I call a 'fail test'. Stop the site briefly and confirm that it break (responds differently). That ensures that the correct site is handling the request and that it's not another site on the server. You can do the same by adding a test.aspx page to the folder above the one that you are trying to lock down. Make sure that it loads the page that you expect it too.

share|improve this answer
    
I've edited my question to answer your questions. –  splattered bits Dec 6 '10 at 20:51
    
It's almost as if it's already cached from previous authentication. I would try Failed Request Tracing (FRT). Create a rule and enable it, then reproduce the situation and look at the .xml file. If you review that, it will show which modules are loaded and details on them. –  Scott Forsyth - MVP Dec 7 '10 at 14:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.