Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got an asp.net app that relies on Request.LogonUserIdentity.Name to be populated with the username of the person logged onto the client machine. In IIS7 on the webserver, I've disabled Anonymous Authentication and enabled ASP.NET Impersonation & Windows Authentication. (I'm logging onto the webserver with a service account, not my own.) When I try to browse to the site from my desktop, I get prompted for my network credentials which fail - 401 Unauthorized.... I'm using .Net 3.5 sp Whatever. The server is running IIS 7.5.

Application Pool:

  • Managed Pipeline Mode: Classic
  • Load User Profile: false
  • Identity: ApplicationPoolIdentity

Web Application:

  • .NET Auth Rules: Allow All Users
  • Enabled auth types: ASP.NET Impersonation, Windows

File-system Folder permissions:

  • Creator Owner: Special Permissions
  • Machine\IUsr: Read & Execute, List folder contents, Read
  • Machine\System: Full Control
  • My Domain Account: Full Control
  • Machine\Administrators: Full Control
  • Machine\Users: Read & Execute, List folder contents, Read
  • Machine\IIS_IUSRS: Read & Execute, List folder contents, Read
  • Trusted Installer: Full Control

I've tried adding Machine\Everyone and Domain\Domain Users with Read and also with Full Control and I'm still being blocked.

share|improve this question

migrated from stackoverflow.com May 3 '11 at 9:31

This question came from our site for professional and enthusiast programmers.

    
can you look at the servers security event log or IIS log and see what user account is in the logon event / log record ? –  Menahem May 2 '11 at 14:14
    
When I try to hit the site and enter my domain credentials, my domain account is recorded in the logon/logoff events. Is it that I essentially need to grant the entire network logon rights to the machine? –  minameismud May 2 '11 at 14:20
    
when you said the user account is in the security log, was the status success or failure ? –  Menahem May 2 '11 at 14:36
    
"An account was successfully logged on." The values under the "Subject" header are blank or null; logon type = 3; values under "New Logon" header are my information. –  minameismud May 2 '11 at 14:40
    
this means you have logon rights to the machine, but the web server turns you down. so i`m guessing that the user permissions for iis folders are amiss. theres a good kb here that deals with exactly this problem, i hope it helps. –  Menahem May 2 '11 at 14:53

2 Answers 2

This is most likely from the loopbackcheck when testing locally on the server. I bet it works if you test it from another server.

Turn off the loopback check using method 2 from this page: http://support.microsoft.com/kb/896861. A reboot isn't required for your change.

As for permissions, with impersonation enabled it will need the authenticated user, plus the app pool user will be needed some some things. So, the key permissions to use are SYSTEM, Administrators, "IIS APPPOOL\{apppoolname}" and a group for the possible users that will authenticate.

share|improve this answer

In IIS 7.5 when you turn on Windows authentication, there is also an option for providers. By default, Negotiate is 1st preference and then NTLM. I've seen issues where negotiate fails because of other setup related issues and then presents user with credential challenge. I've been able to work around this by making NTLM the first provider.

You can also view the site traffic with fiddler to see what's happening when you get challenged for credentials.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.