Let's say I have the following setup:

  • Office network that has an Active Directory server
  • Off-site IIS server

I would like to turn off anonymous access on certain folders on the website with the same, so that users have to authenticate with their Active Directory credentials. I have two questions:

  • What are the steps to do this?
  • Is there a way to have a copy of AD on the IIS machine in case the office network goes down (power outage, etc)?
  • for a server to be able to authenticate users agains an AD the server itself must be a member of the domain. – yrk Mar 3 '12 at 19:54
  • Who says the server OS needs to do it? – Mathias R. Jessen Mar 3 '12 at 23:44
  • @yarek - Okay. How do I do this? Do I need a VPN connection from the web server to the AD server? – anon Mar 5 '12 at 16:24
  • @MathiasR.Jessen - I don't understand what you are asking. Who are you directing the question towards? – anon Mar 5 '12 at 16:25
  • @anon you don't necessarily have to use Windows' built-in security providers for authentication agains AD, since AD is just an LDAP implementation. You could use openLDAP or another plugin for authentication against AD... or PHP's LDAP feature: davidschultz.org/blog/2008/4/10/… – Mathias R. Jessen Mar 5 '12 at 17:19

The normal steps to do this would be:

  1. Join the web server to the domain
  2. Enable Windows Authentication
  3. Set the appropriate NTFS ACLs on the folders that you want to secure
  4. Disable anonymous access to those folders

If the web server cannot me made a member of the domain, you can use third-party or home-grown code to forward the username and password to AD for authentication and only serve up the content upon successful auth, but this is substantially more work usually and implementation would be specific to your configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.