22

Is it possible in IIS to set up a site in IIS and only let users of a certain AD Group get access to it?

18

The following should work, depending on your IIS version. You'll need to add a web.config if you don't have one (though you should on IIS7) in the directory root of your site. The below will allow Domain Admins and deny Domain Users (fairly self explanatory). Make sure you line up the config sections if you already have a section, etc.

<configuration>
  <location path="MyPage.aspx/php/html">
      <system.web>
         <authorization>
            <allow users="DOMAIN\Domain Admins"/>
            <deny users="DOMAIN\Domain Users"/>
         </authorization>
      </system.web>
   </location>
</configuration>

You will need Windows Authentication enabled under Authentication in your site preferences for this to work, obviously, but I assume you already have this enabled.

  • What IIS versions does this work on? – svandragt Sep 2 '14 at 12:22
14

joshatkins' answer does not work in IIS7. For IIS7, you need to use the role attribute. Also, if you want to restrict the whole site, you don't need the location element.

<authorization>
  <allow roles="DOMAIN\Domain Users"/>
  <deny users="*" />
</authorization>
  • 9
    Please don't use references such as "above" or "below" because you have no way of knowing in what order an individual sees the answers. The problem gets worse over time as more answers are posted. You should instead refer to the name of the poster of the answer being referenced. – John Gardeniers Oct 19 '12 at 10:06
11

Just adding a couple more points to the other answers that helped me figure out how to get this working after I had basic AD Authentication working fine with IIS.

  1. Add Role or Feature via Windows Server Manager: Web Server (IIS) --> Web Server --> Security --> URL Authorization.
  2. Close then reopen the IIS Manager (if you have it open), now you will see (under the IIS Section for your site) Authorization Rules. Open this up.
  3. Click on the right side panel: Add Allow Rule
  4. Under Specified roles or user groups type the name of the AD group you need. eg. myDomain\myGroup and select OK.
  5. Repeat 4 for the groups that you need.

if you just want to edit the configuration file directly, then it would look something like this:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        ...
        <security>
            <authorization>
                <remove users="*" roles="" verbs="" />
                <add accessType="Allow" roles="myDomain\myGroup01" />
                <add accessType="Allow" roles="myDomain\myGroup02" />
            </authorization>
        </security>
    </system.webServer>
</configuration>
  • You will also need to enable Windows Authentication (NTLM/Kerb). Otherwise if the browser session identity can't be determined, how could the role based authorization work? After following your direction and enabling Windows authentication, this works! – KFL Mar 25 '16 at 6:35
3

If using the web.config authorization rules do not work (for example because a CGI script runs), you can use the folder permissions system to disable inheritance, remove IIS users (so that nobody has read access) and just add the security group in with read access. You also have to enable some form of authentication method (eg. Basic or Windows Integrated) so that the visitor is recognised.

  • I like this method, may not suit everyone's needs but there's no need to mess around with web.config – sheldonj22 Dec 1 '16 at 12:42
1

Giving read permission on the folder to only that domain group also works.

0

I know it is a very old question but this is something which i need in my test environment.

This approach works for me and I get a popup to login and I can log in without any issue.

I was wondering how can i configure it to use SSO? If the logged in user is a member of security group then do ask for credentials.

My IIS is on Windows Server 2016 1607 and the website is static HTML.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.