1

I've seen this question a few times on the internet, but no answer I've yet seen has solved my problem.

I have forms authentication enabled in my application and anonymous access has been denied:

<configuration>
...
<system.web>      
...  
    <authentication mode="Forms">
        <forms name=".ASPXFORMSAUTH" loginUrl="Account/Authenticate.aspx"></forms>
    </authentication>
    <authorization>
        <deny users="?"/>
    </authorization>

Access to the login page has been enabled:

</system.web>

<location path="Account/Authenticate.aspx">
    <system.web>
        <authorization>
            <allow users="?"/>
        </authorization>
    </system.web>
</location>

Anonymous Authentication is enabled in the project properties dialog and Windows authentication is disabled. I have also checked the applicationhost.config file for IIS Express in my documents. It has all authentication modes except anonymous disabled. I am using IIS express as the debug server.

As far as I know this is everything you are supposed to do to resolve the access denied error, but I'm still getting the following error message in my browser:

Error message 401.2.: Unauthorized: Logon failed due to server configuration. Verify that you have permission to view this directory or page based on the credentials you supplied and the authentication methods enabled on the Web server.

As an interesting side note, if I enable windows authentication the login page will appear correctly. However, this does not work when the site is deployed. If deployed, then activating windows authentication will just cause a JavaScript window to pop-up asking for creds (not the form I made).

Does anyone know how to fix this. My only recourse at this moment is to manually restrict access in the code and have IIS let all the traffic through.

Edit

As a final solution I did just manually authenticate users. As far as IIS knows anonymous access is unrestricted, but the session is checked on every request to verify the user has logged in (the session is where I store my DB connection object per user). For static content I just use HTTP handlers that use a read-only session state to verify access before serving files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.