Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Let's say I have the following setup:

  • Office network that has an Active Directory server
  • Off-site IIS server

I would like to turn off anonymous access on certain folders on the website with the same, so that users have to authenticate with their Active Directory credentials. I have two questions:

  • What are the steps to do this?
  • Is there a way to have a copy of AD on the IIS machine in case the office network goes down (power outage, etc)?
share|improve this question
    
for a server to be able to authenticate users agains an AD the server itself must be a member of the domain. –  yarek Mar 3 '12 at 19:54
    
Who says the server OS needs to do it? –  Mathias R. Jessen Mar 3 '12 at 23:44
    
@yarek - Okay. How do I do this? Do I need a VPN connection from the web server to the AD server? –  anon Mar 5 '12 at 16:24
    
@MathiasR.Jessen - I don't understand what you are asking. Who are you directing the question towards? –  anon Mar 5 '12 at 16:25
    
@anon you don't necessarily have to use Windows' built-in security providers for authentication agains AD, since AD is just an LDAP implementation. You could use openLDAP or another plugin for authentication against AD... or PHP's LDAP feature: davidschultz.org/blog/2008/4/10/… –  Mathias R. Jessen Mar 5 '12 at 17:19

1 Answer 1

The normal steps to do this would be:

  1. Join the web server to the domain
  2. Enable Windows Authentication
  3. Set the appropriate NTFS ACLs on the folders that you want to secure
  4. Disable anonymous access to those folders

If the web server cannot me made a member of the domain, you can use third-party or home-grown code to forward the username and password to AD for authentication and only serve up the content upon successful auth, but this is substantially more work usually and implementation would be specific to your configuration.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.