I'm seeing some strange behavior from a Server 2008 R2 box running .net 4 and IIS 7.5 in an integrated app pool.
The root web.config is pretty clear that I want to use windows authentication.
no surprises there.
I have a directory that I would like to secure, so I've added the following web.config to that directory:
<configuration> <system.web> <authorization> <allow users="MYDOMAIN\MYUSER" /> <deny users="*" /> </authorization> </system.web> </configuration>
Windows Authentication is enabled in IIS, and specified by the root web.config, so I expected the usual Challenge/Response dialog to pop up and ask for a password. Instead I got redirected to a non-existent URL http://mysite.com/Account/Login?ReturnUrl=%2ftestdir
Which seems to be the default login directory for Forms Authentication, which I'm not using so the request returns a 404 error.
ACLs on the underlying directories allow the intended user to access the file.
Anybody seen IIS behave in this manner?