ASP.NET Web.config authentication/authorization settings

Question

I'm trying to configure the IIS Authentication settings from my MVC5 project in the Web.config file.

Here's what I have. I want Windows Authentication enabled and Anonymous Authentication disabled.

But after publishing my package in IIS, the settings are this.

What do I need to do to also set the Anonymous Authentication to Disabled in the Web.config? Isn't that what <deny users "?"/> is supposed to be doing?

@mavora, <deny users "?"/> is using to allow only authenticated users — Husni Salax
– Husni Salax, Commented May 4, 2016 at 14:17
praguan - isn't that the same thing as disallowing anonymous? — madvora
– madvora, Commented May 4, 2016 at 14:21
@mavora, deny = * means deny everyone; deny = ? means deny unauthenticated users — Husni Salax
– Husni Salax, Commented May 4, 2016 at 14:23
Thanks. I was assuming that was what changed the Anonymous Authentication setting. — madvora
– madvora, Commented May 4, 2016 at 14:24

Husni Salax · Accepted Answer · 2016-05-04 14:27:48Z

7

Here we go step by step:

Open Internet Information Services (IIS) Manager:
- If you are using Windows Server 2012 or Windows Server 2012 R2:
- On the taskbar, click Server Manager, click Tools, and then click Internet Information Services (IIS) Manager.
- If you are using Windows 8 or Windows 8.1:
- Hold down the Windows key, press the letter X, and then click Control Panel. Click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.
- If you are using Windows Server 2008 or Windows Server 2008 R2:
- On the taskbar, click Start, point to Administrative Tools, and then click
  
  Internet Information Services (IIS) Manager.
- If you are using Windows Vista or Windows 7:
- On the taskbar, click Start, and then click Control Panel.
- Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.
  1. In the Connections pane, expand the server name, expand Sites, and go to the level in the hierarchy pane that you want to configure, and then click the Web site or Web application.
  2. Scroll to the Security section in the Home pane, and then double-click Authentication. 4.In the Authentication pane, select Anonymous Authentication, and then click Disable in the Actions pane.

Or you can disable by config file:

<location path="Contoso">
   <system.webServer>
      <security>
         <authentication>
            <anonymousAuthentication enabled="false" />   <!--This line you need-->
            <basicAuthentication enabled="true" defaultLogonDomain="Contoso" />
            <windowsAuthentication enabled="true" />
          </authentication>
      </security>
   </system.webServer>
</location>

Deny Anonymous user to access entire website:

   <authorization>
    <deny users="?" ></deny>    
    </authorization>

Hope it helps;)

edited May 4, 2016 at 14:27

answered May 4, 2016 at 14:05

Husni Salax

2,0181 gold badge21 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

madvora Over a year ago

I see where you got these settings. iis.net/configreference/system.webserver/security/… They do not work and bring up an error in IIS, and I'm excluding the location path and basicaauthentication parts.

Husni Salax Over a year ago

@try to use that script where I showed to disable by config file ;)

madvora Over a year ago

Sorry, but your first set of code errors out similar to this... stackoverflow.com/questions/28419304/… Your second set of code is what I already have.

David Rogers Over a year ago

I concur with @Madvora, the first set of code doesn't seem to work for me either. Do you have a example of a full web.config with that implemented?

Karthik M R · Accepted Answer · 2016-05-04 13:56:17Z

-2

Right click on Anonymous Authentication and click disable

answered May 4, 2016 at 13:56

Karthik M R

9901 gold badge7 silver badges12 bronze badges

2 Comments

madvora Over a year ago

Yeah I know how to change the settings in IIS, I'm trying to set this in the Web.config and wondering why my settings there don't translate.

Karthik M R Over a year ago

It only works when you run locally(through VS),but for IIS, you need to disable it.

Collectives™ on Stack Overflow

ASP.NET Web.config authentication/authorization settings

2 Answers 2

4 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

4 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related