I have a .NET (MVC2) website that is in development. I have deployed it to some production infrastructure, and tested it over the internet with anonymous access (as it will be once it is live) and it works fine. Between now and the go-live date I would like to restrict access to a small test group.

However, when I turn off anonymous access (I'm using IIS 7 on Windows 2008 R2 64-bit) and enable Basic Authentication, two things go wrong: first, it interferes with the site authentication, and redirects to the configured site login page, and second, for some reason the stylesheets stop 'working'. i.e. the site appears as if it has no stylesheets, even though they are being downloaded correctly (as viewed in Fiddler / Firebug.)

What I want is to secure access to the server - I don't want to use Basic Authentication as the authentication mechanism for the MVC website - that is handled by standard forms authentication. I simply want to stop people snooping the site before it goes live.

I've had this before, and always struggled with the lack of an easy / obvious "protect this server with a password" functionality.

There must be a simple answer. (I'm thinking of a functional equivalent to a .htaccess file, but for IIS)?

[UPDATE] Following on from my near-miss (see answer below), what I want is Windows authentication to control access to the site, and ASP.NET authentication to control a user's interaction with the website (their identity, whether the appear logged in / out, etc.)

  • I don't think there is any easy way except making sure that all pages (url routes) are protected via Forms Authentication. ASP.NET and IIS7 are designed to work together for those types of situations, so setting IIS to "basic" tells your application to "use basic too". As for the css, I'm guessing it has to do with web.config files in your css root folders.
    – Nate
    Aug 28 '10 at 16:49
  • I don't think there is either - it's just so weird that there's no way to disconnect IIS from ASP.NET - this cannot be an unusual use case? The requirement is so simple - and I do NOT want to have to start mucking around with live configuration files just to achieve this. Aug 28 '10 at 16:59
  • Is the production box in the sane office as your test group, or in a co-location? Aug 31 '10 at 2:54
  • Co-lo. The developers have VPN access, but the test group are just regular office people - and we can't install the VPN software on their machines. In addition, certain people will want access when out of the office (for demonstration purposes), so IP-restrictions won't work. Aug 31 '10 at 11:11

You may be able to do what you want by setting IP Address and Domain Restrictions for the site. It is an option in IIS Manager.


OK - so this may have been my mistake. In order to get IIS/ASP.NET playing nicely you cannot simply rely on the IIS Authentication module. Whilst I was busy enabling / disabling options in the IIS manager snap-in, the problem I was having (the redirect) was caused by a web.config setting:

<authentication mode="Forms">
<forms loginUrl="~/logon" protection="All" path="/" />

Irrespective of the option you select in IIS (Anonymous, Basic, Windows, Forms etc.) the web.config seems to override / interfere with the selection.

The answer therefore is to replace the authentication element in web.config with one that states Windows authentication:

<authentication mode="Windows"></authentication>

And then to remove anonymous access via the IIS module, and select Basic instead.

alt text

  • Actually - this doesn't work - as it now logs the user into the site as the Windows user - which doesn't now make any sense. I can now express my problem a bit better though: I want Windows authentication to control access to the site, and ASP.NET authentication to control a user's interaction with the website (whether they appear logged in, access to secure areas - my account etc.) Sep 1 '10 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.