Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a Web app running in IIS7 (Server 2008 R2). I now need to allow external access with an SSL certificate, so certain users (e.g. the owner of the company) can use it remotely without VPN. They want to roll out the external access only to those specific users at first (thinking: a Windows credential prompt), BUT everyone will still need access internally (HTTP), without the prompt.

I have the SSL cert installed on the server and public DNS configured. I've been trying to figure out how to work the authentication/authorization. I was thinking I need to disable Anonymous authn and set Windows authn, then I keep coming back to 'URL Authorization' in my research for the group setting; however, when I tried URL authz, (removed allow all, added allow rule for the special group), it broke the site internally (403.2 Forbidden, I believe it was). I thought maybe setting up a second site in IIS pointing to the same program would work, but the exact same thing happened (and again with a new app pool, just for kicks).

So I guess my question is, how would you do this: allow external access, limited to users in a specific AD group, while still allowing internal access without a credentials prompt?

How do I separate the external HTTPS and internal HTTP authorization requirements? Will I need to just copy the entire contents of the app in Windows Explorer to a new folder and create my external site from that? Is Windows authentication the correct option for this?

I did come across this, which refers to creating a custom module. While it sounds like a solution, it's not one I'm familiar with, and I just wondered if there is a simpler way to get it to work:


share|improve this question
up vote 3 down vote accepted

Is Windows Authentication the correct option for this?

  • Yes, it sounds like Integrated Windows Authentication is appropriate for your requirements.
  • You won't need a password to login if it is configured correctly.
  • Essentially the browser will pass the credentials to IIS but will fallback on password authentication as last resort when trying to authenticate the user.

This should give you a good start in Understanding IIS Authentication.

  • Regarding your prior 403.2 problems, you probably needed to examine file permissions in relation to the user that authenticated.
  • Take a look at: Pass-through Authentication
  • Remember that Windows Authentication means the windows user on the client-side is the user authenticated through to the server.

To limit access to a particular group in AD only for the external access:

share|improve this answer
thanks, I will read through that. Any idea on limiting access to a particular group in AD only for the external access? :) – White Island Jun 29 '12 at 22:01
Look at the section Checking Role Membership in Code in the MSDN article. – Somantra Jun 29 '12 at 22:06
@White Island, I think you may want a Domain Name Allow Rule combined with separate virtual directories for external and internal access. – Somantra Jun 29 '12 at 23:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.