I've seen this question a few times on the internet, but no answer I've yet seen has solved my problem.
I have forms authentication enabled in my application and anonymous access has been denied:
<configuration> ... <system.web> ... <authentication mode="Forms"> <forms name=".ASPXFORMSAUTH" loginUrl="Account/Authenticate.aspx"></forms> </authentication> <authorization> <deny users="?"/> </authorization>
Access to the login page has been enabled:
</system.web> <location path="Account/Authenticate.aspx"> <system.web> <authorization> <allow users="?"/> </authorization> </system.web> </location>
Anonymous Authentication is enabled in the project properties dialog and Windows authentication is disabled. I have also checked the applicationhost.config file for IIS Express in my documents. It has all authentication modes except anonymous disabled. I am using IIS express as the debug server.
As far as I know this is everything you are supposed to do to resolve the access denied error, but I'm still getting the following error message in my browser:
Error message 401.2.: Unauthorized: Logon failed due to server configuration. Verify that you have permission to view this directory or page based on the credentials you supplied and the authentication methods enabled on the Web server.
Does anyone know how to fix this. My only recourse at this moment is to manually restrict access in the code and have IIS let all the traffic through.
As a final solution I did just manually authenticate users. As far as IIS knows anonymous access is unrestricted, but the session is checked on every request to verify the user has logged in (the session is where I store my DB connection object per user). For static content I just use HTTP handlers that use a read-only session state to verify access before serving files.