Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to secure an MVC.NET site on IIS7.5 with basic authentication. I'd rather not setup an entire windows account for this as I don't want the user to have that much privilege. I also don't want to implement a data driven authentication solution. I just want quick way to create a user that can only gain access to the website and nothing else.

Is there a way to do this by storing the credentials in the web.config file? Or use the IIS Managed users? The managed users seem like overkill as I don't want the user to actually be able to manage the site, just gain access to view it.

share|improve this question
up vote 2 down vote accepted

If I remember correctly you can store the credentials for users directly in the web.config file but only when used in combination with the Forms Authentication Provider.

It really isn't recommended to store credentials like this, especially when you could easily setup the default ASP.NET Membership provider to use a local SQLCE instance.

<authentication mode="Forms"> 
    <forms name=".ASPNETAUTH"> 
        <credentials passwordFormat="Clear"> 
             <user name="test" password="test"/> 
share|improve this answer
Doen't this answer mean that one is running forms-auth and there is not running basic-auth. / HTTP-auth.? Or can I use forms-auth provide HTTP-Auth.? Thought this won't work. – Marc Jun 13 '13 at 6:47

Most of the built-in IIS authentication methods use Windows accounts in some way or another, so if you don;t want to do any major work for this, you are going to have to use these -- you will want to create accounts that are reasonably locked down.

It is usually sufficient to:

  1. create a group (e.g. Web Users)
  2. add the individual accounts to that group
  3. remove the accounts from Users (which effectively gets rid of a lot of the default permissions)
  4. give the Web Users group read permissions to the web site folder (and selectively any modify permissions required -- e.g. upload directories)
  5. add the group to the relevant 'Deny...' entries in Local Security Policy / User Rights Assignment

Optionally, you might want to add recursive deny full control ACEs for that group to the disks, registry hives and any other DACL-driven resources -- SetACL should be able to do most of them (see

If you really must use a custom list of users, then (as @BrentPabst said) Forms Authentication is the only real way (see, but you will need to create the ASP.NET login page.

I've not tried IIS Manager Authentication but, from what I can see, it only applies to FTP sites, not Web Sites.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.