Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a simple one page internal app that I just moved to IIS7.5. After enabling basic authentication and disabled anonymous authentication only local users can authenticate.

What I have done far:

  • Enabled basic authentication and disabled anonymous authentication.
  • Created group in Active Directory with accounts.
  • Added AD group to the local User group.
  • Added Network Service account to the directory.
  • Created a local test user. - Works.
  • Removed the local test user from all groups. - Still works.
  • I'm using DOMAIN\USER for the username.

There has to be something simple I'm missing.

share|improve this question
    
describe what happens when it fails? –  TristanK Oct 28 '11 at 1:16
add comment

1 Answer

To enable Windows authentication for a page, you'd normally:

  • Create a group in AD
  • Populate that group with users

  • In IIS Manager, open the directory you want to secure

  • Edit the Authentication settings for that directory
  • typically, they'd be:
    • enable Windows Authentication
    • disable Anonymous to avoid mucking around with file system permissions too much

At this point, file system permissions will be used to govern whether an authenticated user has access to the site or not. So you just need to check file system permissions are OK:

  • Right-click and Explore the website in question
  • Edit the Security settings on the file you want to be authenticated (if it's not the whole folder)
    • Ensure that anonymous users are removed from Read permission to the file
    • Ensure that your chosen group does have Read permission to the file
    • Ensure the App Pool Identity has Read access to everything

In your question, you talk about Integrated Windows authentication, but then describe enabling Basic authentication - that's not the same thing; from the client end (at least for IE), Basic always prompts for a username and password, and it transmits it unsecurely; Windows auth is more secure, and doesn't prompt for authentication (with caveats including dots in the URL, and Local Intranet Zone-ing).

share|improve this answer
    
Updated the title. I checked everything you have listed. My domain account has full access. But only non domain users can authenticate. –  NitroxDM Nov 3 '11 at 21:51
    
I turned off "Windows Authentication" and turned on "Basic Authentication" now it works with the domain. That's great... but now it's passing credentials in near clear text. –  NitroxDM Nov 4 '11 at 17:26
    
So the short version is don't use Basic because that's what Basic does. Why do you want to use Basic? –  TristanK Nov 4 '11 at 22:26
    
I just want to us the existing AD so I don't have yet another ACL to worry about. –  NitroxDM Nov 4 '11 at 22:28
    
Yes, that's normal. The authentication type isn't typically part of the decision process on that. So why use Basic? Because Integrated doesn't work? If not, run DelegConfig and see if that helps you understand the reasons Kerberos might be broken. –  TristanK Nov 4 '11 at 22:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.