I am investigating this problem. I have a CGI application that I publish through a website published in IIS7.
EDIT: I changed the web.config to use url authorization. This is the web.config of a folder called secure and this is the web.config of that specific folder
<?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <security> <authorization> <remove users="*" roles="" verbs="" /> <add accessType="Allow" roles="MyDOMAIN\MyRole" /> <add accessType="Deny" users="*" /> </authorization> </security> </system.webServer> </configuration>
With that config it is not working but if I remove the Deny it is working again, maybe rule order?
I changed website configuration in order to use windows authentication and then deny to all users but one with the current web.config
<?xml version="1.0" encoding="UTF-8"?> <configuration> <system.webServer> <handlers accessPolicy="Read, Execute, Script" /> <directoryBrowse enabled="false" /> </system.webServer> <system.web> <authentication mode="Windows"> </authentication> <authorization> <allow users="MYDOMAIN\myname2"/> <deny users="?"/> <deny users="*"/> <deny users="MYDOMAIN\myname"/> </authorization> </system.web> </configuration>
Unfortunately I can access the application both with myname and myname2 (both the published cgi and the IIS welcome page).
Any hint on how to configure it? Thanks!
EDIT: I have found this post IIS7: How to block access with a web.config file? where it marks web.config as
> <system.webServer> > <security> > <authorization> > <remove users="*" roles="" verbs="" /> > <add accessType="Allow" roles="Administrators" /> > </authorization> > </security> </system.webServer>
but the cgi keeps on being executed