0

I have a customer who has hit us with an unusual requirement, they would like to restrict users access by IP address, so that User 1 can only access the system from IP addresses A,B,C and User 2 can access from addresses A-D and F.

I'm not aware if it is possible to restrict authentication by a combination of IP address' per username

1
  • 3
    I don't believe this capability is built in to IIS, but it would be fairly easy to implement in Global.asax or a custom authentication provider.
    – Greg Askew
    Jun 10, 2016 at 16:30

1 Answer 1

2

There is not built-in mechanism to achieve this. At least not directly in the manner you're asking.

You can, however, come pretty close.

First off, how do you define a "users"? Are they Active Directory users and the web servers is a member of the same domain name? If so, then you can disable Anonymous authentication in he website and change over to Integration Windows Authentication. You than achieve access control by setting customer security permissions in NTFS - you create an AD group that will be used to control access to the website, give it read/execute permissions to the the web root folder, then add all AD users to the group. When they connect to the site, they'll be authenticated automatically by AD and allowed to view the website.

You then us the built-in Domain and IP Restrictions in IIS - set the default rule for IP restrictions to deny-all, then add each authorized IP address.

The part you can't achieve is that any user can connect form any IP within the list, you can't restrict it any further. If you want to do better than this, you'll need to code the behavior yourself, directly into asp.net application's code-behind (web forms), model (MVC) or into the global.asax (like Greg mentioned).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .