Restricting users to certain webpages on IIS server, that uses a CMS to manage webpages/content

Question

I plan on using ExpressionEngine as my CMS on an intranet, IIS server.

The reason I want to use IIS is to take advantage of the ability to restrict certain active-directory groups to certain pages.

For example, only the student group can access intranet/students, and staff can only access intranet/staff

But where my problem comes into play is that ExpressionEngine templating system is a little complex. It is completely database driven, which by default you can only edit the templates within their web based template editor, but there is a setting you can enable to save each template as a flat file, and it will automatically save the template as "nameoftemplate".php, so in my example, it would be news.php

For example, there are template groups, which have templates within them.

For example, the students template group may have 4 or 5 templates, so the URL's to them would be:

http://intranet/students/news http://intranet/students/calendar http://intranet/students/forms http://intranet/students/policies

and the same goes for staff.

As you see, the URL is http://intranet..., that is the URL for being on campus, for accessing the intranet from off-campus, you'd have to type in http://intranet.domain.com/students/

Going back to how the CMS works with templates...

The student news template (http://intranet/students/news) is located at /web/system/templates/students/news.php

On an apache server, I could edit the config to restrict access to a certain active-directory group based on its URL and not the remote path (/web/system/templates/students/news) of the file. You're probably wondering why I just don't go down that path and use that...because it will ask you to log in with your username & password whether you're accessing it from campus (http://intranet/students/news) or off-campus (http://intranet.domain.com/students/news)

I want to be able to let the users on campus view http://intranet/students/news without having to log in, but if they access it from off-campus...then it will ask them to log-in.

They all use IE7 and are use to being able to access their appropriate areas without ever being asked to authenticate, and if they were to be asked now...it would flip their work-lives upside down (yes...it is sad)

This may not be possible, but either way let me know.

Answer 1

Just make sure that IIS is using NTLM for authentication on the site and IE will log in automatically in your Intranet. Set NTFS permissions on the folders to implement your security model. Word of caution, though. Make sure you don't remove write access to the folders for the account that IIS is running as otherwise your CMS won't be able to write the template files.