I am using IIS 7.5 and want to change a website from using anonymous authentication to basic authentication. I access the Authentication feature, disable anonymous authentication then enable basic authentication. When I access the website I get the following error

HTTP Error 401.2 - Unauthorized
You are not authorized to view this page due to invalid authentication headers.
Module: IIS Web Core
Notification: AuthenticateRequest
Handler: StaticFile
Error Code: 0x80070005
Requested URL: http://mywebsite.com:80/
Physical Path: \\myserver\myfolder
Logon Method: Not yet determined
Logon User: Not yet determined

I was expecting to get issued with a challenge (ask for username and password) but nothing, just the error.

Turning on failed request tracing I can see the following errors

ModuleName: IIS Web Core 
Notification: 2 
HttpStatus: 401 
HttpReason: Unauthorized 
HttpSubStatus: 2 
ErrorCode: 2147942405 
ErrorCode: Access is denied. (0x80070005)

A couple of lines before this I guess the request is asking for anonymous access and is failing.

RequestAuthType: 1
RequestAuthType: Anonymous

What I'd like to know is why doesn't the server issue a challenge?

  • After changing it, did you use the same browser? Typically browsers will "cache" these requests and it requires a restart of the browser to work. – Nathan C May 17 '13 at 13:22
  • Make sure that Basic Authentication is enabled on both the Server level and site/application level, not just one of them – Mathias R. Jessen May 17 '13 at 13:23
  • @NathanC just to double check i closed and reopened my browser. same error – Kevin Brydon May 17 '13 at 13:25
  • @MathiasR.Jessen I have anonymous and basic authentication enabled at server level and only basic enabled at site level – Kevin Brydon May 17 '13 at 13:26

Looks like I had a problem in my applicationHost.config.

I added the following to the <globalModules> section

    <add name="BasicAuthenticationModule" image="%windir%\System32\inetsrv\authbas.dll" />

And I added the following to the overall server <system.webserver> section

<location path="" overrideMode="Allow">
            <add name="BasicAuthenticationModule" lockItem="true" />
<location path="" overrideMode="Allow">

the ... denotes other content in each of the sections, the important parts are the <add /> sections

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.