IIS Authentication for static HTML pages

up vote
-1
down vote

favorite

I have an IIS site hosting a bunch of static HTML pages. I want access to these to be controlled via AD group membership, and in the event the user is not in the AD group, they should be redirected to an access denied page.

I have made some progress on this, and my web.config currently looks like this.

<?xml version="1.0" encoding="UTF-8"?>

<configuration>



    <system.webServer>

    <modules>

        <!-- Re-add auth modules (in their original order) to run for all static and dynamic requests -->

        <remove name="FormsAuthentication" />

        <add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />

        <remove name="DefaultAuthentication" />

        <add name="DefaultAuthentication" type="System.Web.Security.DefaultAuthenticationModule" />

        <remove name="RoleManager" />

        <add name="RoleManager" type="System.Web.Security.RoleManagerModule" />

        <remove name="UrlAuthorization" />

        <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />

    </modules>

    </system.webServer>



<system.web>

        <authorization>

            <allow roles="AD GROUP NAME" />

            <deny users="*" />

        </authorization>

        <customErrors>

            <error redirect="access-denied.html" statusCode="401" />

        </customErrors>

</system.web>



    <location path="access-denied.html">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 

    <location path="assets">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 



</configuration>

This has locked the access to the pages down, and allows access to the access denied page, but it doesn't redirect unauthorised users to the access denied page, it prompts for credentials. Can anyone help me out with the redirect?

iis

share|improve this question

asked 15 hours ago

Mark

3551520

• 
  
  
  

  
  

  
  
  
  
  
  

  
  I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
  – LittleSweetSeas
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  @LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
  – Mark
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
  – LittleSweetSeas
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  @LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
  – Mark
  14 hours ago
  
  
  

  
  
  
  

add a comment | 

up vote
-1
down vote

favorite

I have an IIS site hosting a bunch of static HTML pages. I want access to these to be controlled via AD group membership, and in the event the user is not in the AD group, they should be redirected to an access denied page.

I have made some progress on this, and my web.config currently looks like this.

<?xml version="1.0" encoding="UTF-8"?>

<configuration>



    <system.webServer>

    <modules>

        <!-- Re-add auth modules (in their original order) to run for all static and dynamic requests -->

        <remove name="FormsAuthentication" />

        <add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />

        <remove name="DefaultAuthentication" />

        <add name="DefaultAuthentication" type="System.Web.Security.DefaultAuthenticationModule" />

        <remove name="RoleManager" />

        <add name="RoleManager" type="System.Web.Security.RoleManagerModule" />

        <remove name="UrlAuthorization" />

        <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />

    </modules>

    </system.webServer>



<system.web>

        <authorization>

            <allow roles="AD GROUP NAME" />

            <deny users="*" />

        </authorization>

        <customErrors>

            <error redirect="access-denied.html" statusCode="401" />

        </customErrors>

</system.web>



    <location path="access-denied.html">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 

    <location path="assets">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 



</configuration>

This has locked the access to the pages down, and allows access to the access denied page, but it doesn't redirect unauthorised users to the access denied page, it prompts for credentials. Can anyone help me out with the redirect?

iis

share|improve this question

asked 15 hours ago

Mark

3551520

• 
  
  
  

  
  

  
  
  
  
  
  

  
  I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
  – LittleSweetSeas
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  @LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
  – Mark
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
  – LittleSweetSeas
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  @LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
  – Mark
  14 hours ago
  
  
  

  
  
  
  

add a comment | 

up vote
-1
down vote

favorite

up vote
-1
down vote

favorite

I have an IIS site hosting a bunch of static HTML pages. I want access to these to be controlled via AD group membership, and in the event the user is not in the AD group, they should be redirected to an access denied page.

I have made some progress on this, and my web.config currently looks like this.

<?xml version="1.0" encoding="UTF-8"?>

<configuration>



    <system.webServer>

    <modules>

        <!-- Re-add auth modules (in their original order) to run for all static and dynamic requests -->

        <remove name="FormsAuthentication" />

        <add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />

        <remove name="DefaultAuthentication" />

        <add name="DefaultAuthentication" type="System.Web.Security.DefaultAuthenticationModule" />

        <remove name="RoleManager" />

        <add name="RoleManager" type="System.Web.Security.RoleManagerModule" />

        <remove name="UrlAuthorization" />

        <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />

    </modules>

    </system.webServer>



<system.web>

        <authorization>

            <allow roles="AD GROUP NAME" />

            <deny users="*" />

        </authorization>

        <customErrors>

            <error redirect="access-denied.html" statusCode="401" />

        </customErrors>

</system.web>



    <location path="access-denied.html">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 

    <location path="assets">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 



</configuration>

This has locked the access to the pages down, and allows access to the access denied page, but it doesn't redirect unauthorised users to the access denied page, it prompts for credentials. Can anyone help me out with the redirect?

iis

share|improve this question

asked 15 hours ago

Mark

3551520

I have an IIS site hosting a bunch of static HTML pages. I want access to these to be controlled via AD group membership, and in the event the user is not in the AD group, they should be redirected to an access denied page.

I have made some progress on this, and my web.config currently looks like this.

<?xml version="1.0" encoding="UTF-8"?>

<configuration>



    <system.webServer>

    <modules>

        <!-- Re-add auth modules (in their original order) to run for all static and dynamic requests -->

        <remove name="FormsAuthentication" />

        <add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />

        <remove name="DefaultAuthentication" />

        <add name="DefaultAuthentication" type="System.Web.Security.DefaultAuthenticationModule" />

        <remove name="RoleManager" />

        <add name="RoleManager" type="System.Web.Security.RoleManagerModule" />

        <remove name="UrlAuthorization" />

        <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />

    </modules>

    </system.webServer>



<system.web>

        <authorization>

            <allow roles="AD GROUP NAME" />

            <deny users="*" />

        </authorization>

        <customErrors>

            <error redirect="access-denied.html" statusCode="401" />

        </customErrors>

</system.web>



    <location path="access-denied.html">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 

    <location path="assets">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 



</configuration>

This has locked the access to the pages down, and allows access to the access denied page, but it doesn't redirect unauthorised users to the access denied page, it prompts for credentials. Can anyone help me out with the redirect?

iis

iis

share|improve this question

asked 15 hours ago

Mark

3551520

share|improve this question

asked 15 hours ago

Mark

3551520

share|improve this question

share|improve this question

asked 15 hours ago

Mark

3551520

asked 15 hours ago

Mark

3551520

asked 15 hours ago

Mark

3551520

3551520

• 
  
  
  

  
  

  
  
  
  
  
  

  
  I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
  – LittleSweetSeas
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  @LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
  – Mark
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
  – LittleSweetSeas
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  @LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
  – Mark
  14 hours ago
  
  
  

  
  
  
  

add a comment | 

• 
  
  
  

  
  

  
  
  
  
  
  

  
  I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
  – LittleSweetSeas
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  @LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
  – Mark
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
  – LittleSweetSeas
  15 hours ago
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  @LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
  – Mark
  14 hours ago
  
  
  

  
  
  
  

I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
– LittleSweetSeas
15 hours ago

I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
– LittleSweetSeas
15 hours ago

@LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
– Mark
15 hours ago

@LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
– Mark
15 hours ago

Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
– LittleSweetSeas
15 hours ago

Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
– LittleSweetSeas
15 hours ago

@LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
– Mark
14 hours ago

@LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
– Mark
14 hours ago

add a comment | 

active

oldest

votes

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

 

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53371908%2fiis-authentication-for-static-html-pages%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

active

oldest

votes

active

oldest

votes

active

oldest

votes

active

oldest

votes

 

draft saved

draft discarded

 

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53371908%2fiis-authentication-for-static-html-pages%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

Name

Name

Email

Required, but never shown

Email

Required, but never shown

Email

Required, but never shown

Email

Required, but never shown

Name

Name

Email

Required, but never shown

Email

Required, but never shown

Email

Required, but never shown

Email

Required, but never shown

This page is only for reference, If you need detailed information, please check here