IIS Authentication for static HTML pages











up vote
-1
down vote

favorite












I have an IIS site hosting a bunch of static HTML pages. I want access to these to be controlled via AD group membership, and in the event the user is not in the AD group, they should be redirected to an access denied page.



I have made some progress on this, and my web.config currently looks like this.



<?xml version="1.0" encoding="UTF-8"?>

<configuration>



    <system.webServer>

    <modules>

        <!-- Re-add auth modules (in their original order) to run for all static and dynamic requests -->

        <remove name="FormsAuthentication" />

        <add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />

        <remove name="DefaultAuthentication" />

        <add name="DefaultAuthentication" type="System.Web.Security.DefaultAuthenticationModule" />

        <remove name="RoleManager" />

        <add name="RoleManager" type="System.Web.Security.RoleManagerModule" />

        <remove name="UrlAuthorization" />

        <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />

    </modules>

    </system.webServer>



<system.web>

        <authorization>

            <allow roles="AD GROUP NAME" />

            <deny users="*" />

        </authorization>

        <customErrors>

            <error redirect="access-denied.html" statusCode="401" />

        </customErrors>

</system.web>



    <location path="access-denied.html">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 

    <location path="assets">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 



</configuration>


This has locked the access to the pages down, and allows access to the access denied page, but it doesn't redirect unauthorised users to the access denied page, it prompts for credentials. Can anyone help me out with the redirect?






iis







share|improve this question






















  • I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
    – LittleSweetSeas
    15 hours ago










  • @LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
    – Mark
    15 hours ago










  • Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
    – LittleSweetSeas
    15 hours ago










  • @LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
    – Mark
    14 hours ago

















up vote
-1
down vote

favorite












I have an IIS site hosting a bunch of static HTML pages. I want access to these to be controlled via AD group membership, and in the event the user is not in the AD group, they should be redirected to an access denied page.



I have made some progress on this, and my web.config currently looks like this.



<?xml version="1.0" encoding="UTF-8"?>

<configuration>



    <system.webServer>

    <modules>

        <!-- Re-add auth modules (in their original order) to run for all static and dynamic requests -->

        <remove name="FormsAuthentication" />

        <add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />

        <remove name="DefaultAuthentication" />

        <add name="DefaultAuthentication" type="System.Web.Security.DefaultAuthenticationModule" />

        <remove name="RoleManager" />

        <add name="RoleManager" type="System.Web.Security.RoleManagerModule" />

        <remove name="UrlAuthorization" />

        <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />

    </modules>

    </system.webServer>



<system.web>

        <authorization>

            <allow roles="AD GROUP NAME" />

            <deny users="*" />

        </authorization>

        <customErrors>

            <error redirect="access-denied.html" statusCode="401" />

        </customErrors>

</system.web>



    <location path="access-denied.html">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 

    <location path="assets">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 



</configuration>


This has locked the access to the pages down, and allows access to the access denied page, but it doesn't redirect unauthorised users to the access denied page, it prompts for credentials. Can anyone help me out with the redirect?






iis







share|improve this question






















  • I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
    – LittleSweetSeas
    15 hours ago










  • @LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
    – Mark
    15 hours ago










  • Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
    – LittleSweetSeas
    15 hours ago










  • @LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
    – Mark
    14 hours ago















up vote
-1
down vote

favorite









up vote
-1
down vote

favorite











I have an IIS site hosting a bunch of static HTML pages. I want access to these to be controlled via AD group membership, and in the event the user is not in the AD group, they should be redirected to an access denied page.



I have made some progress on this, and my web.config currently looks like this.



<?xml version="1.0" encoding="UTF-8"?>

<configuration>



    <system.webServer>

    <modules>

        <!-- Re-add auth modules (in their original order) to run for all static and dynamic requests -->

        <remove name="FormsAuthentication" />

        <add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />

        <remove name="DefaultAuthentication" />

        <add name="DefaultAuthentication" type="System.Web.Security.DefaultAuthenticationModule" />

        <remove name="RoleManager" />

        <add name="RoleManager" type="System.Web.Security.RoleManagerModule" />

        <remove name="UrlAuthorization" />

        <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />

    </modules>

    </system.webServer>



<system.web>

        <authorization>

            <allow roles="AD GROUP NAME" />

            <deny users="*" />

        </authorization>

        <customErrors>

            <error redirect="access-denied.html" statusCode="401" />

        </customErrors>

</system.web>



    <location path="access-denied.html">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 

    <location path="assets">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 



</configuration>


This has locked the access to the pages down, and allows access to the access denied page, but it doesn't redirect unauthorised users to the access denied page, it prompts for credentials. Can anyone help me out with the redirect?






iis







share|improve this question













I have an IIS site hosting a bunch of static HTML pages. I want access to these to be controlled via AD group membership, and in the event the user is not in the AD group, they should be redirected to an access denied page.



I have made some progress on this, and my web.config currently looks like this.



<?xml version="1.0" encoding="UTF-8"?>

<configuration>



    <system.webServer>

    <modules>

        <!-- Re-add auth modules (in their original order) to run for all static and dynamic requests -->

        <remove name="FormsAuthentication" />

        <add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />

        <remove name="DefaultAuthentication" />

        <add name="DefaultAuthentication" type="System.Web.Security.DefaultAuthenticationModule" />

        <remove name="RoleManager" />

        <add name="RoleManager" type="System.Web.Security.RoleManagerModule" />

        <remove name="UrlAuthorization" />

        <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />

    </modules>

    </system.webServer>



<system.web>

        <authorization>

            <allow roles="AD GROUP NAME" />

            <deny users="*" />

        </authorization>

        <customErrors>

            <error redirect="access-denied.html" statusCode="401" />

        </customErrors>

</system.web>



    <location path="access-denied.html">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 

    <location path="assets">

        <system.web>

            <authorization>

                <allow users="*" />    <!-- Allow all other users -->

            </authorization>

        </system.web>

    </location> 



</configuration>


This has locked the access to the pages down, and allows access to the access denied page, but it doesn't redirect unauthorised users to the access denied page, it prompts for credentials. Can anyone help me out with the redirect?






iis




iis






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked 15 hours ago









Mark

3551520




3551520












  • I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
    – LittleSweetSeas
    15 hours ago










  • @LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
    – Mark
    15 hours ago










  • Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
    – LittleSweetSeas
    15 hours ago










  • @LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
    – Mark
    14 hours ago




















  • I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
    – LittleSweetSeas
    15 hours ago










  • @LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
    – Mark
    15 hours ago










  • Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
    – LittleSweetSeas
    15 hours ago










  • @LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
    – Mark
    14 hours ago


















I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
– LittleSweetSeas
15 hours ago




I think you should enable your custom error section by putting <customErrors mode="On">, otherwise it would be ignored
– LittleSweetSeas
15 hours ago












@LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
– Mark
15 hours ago




@LittleSweetSeas thanks for the suggestion, although I just tried this and it hasn't made any difference.
– Mark
15 hours ago












Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
– LittleSweetSeas
15 hours ago




Ok - so you may check Authentication settings for your site in IIS, ensuring to enable Windows Authentication.
– LittleSweetSeas
15 hours ago












@LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
– Mark
14 hours ago






@LittleSweetSeas I can confirm anonymous and windows authentication are both enabled. Windows has NTLM set as first provider.
– Mark
14 hours ago



















active

oldest

votes











Your Answer






StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














 

draft saved


draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53371908%2fiis-authentication-for-static-html-pages%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown






























active

oldest

votes













active

oldest

votes









active

oldest

votes






active

oldest

votes
















 

draft saved


draft discarded



















































 


draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53371908%2fiis-authentication-for-static-html-pages%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

'app-layout' is not a known element: how to share Component with different Modules

Image
0 My application was working fine until I decided to go with lazy loading: So, my shared component looks like this: import { Component, Renderer2 } from '@angular/core'; export interface FormModel { captcha?: string; } @Component({ selector: 'app-layout', templateUrl: './app-layout.component.html', styleUrls: ['./app-layout.css'] }) export class FullLayoutComponent { } app-layout.component.ts I am using this component in my Another component say school-home.component.html like this: <app-layout> </app-layout> and it was working fine until I created a Module school-home.module.ts like this: import { NgModule } from '@angular/core'; import { CommonModule } from '@angular/common'; import { SchoolhomeRoutingModule ...
Read more

android studio warns about leanback feature tag usage required on manifest while using Unity exported app?

Image
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box; } 0 This is a simple project showing cubes on Unity, exported to android project and imported on Android studio. On maifest file it showed following warning: Expecting <uses-feature android:name="android.software.leanback" android:required="false" /> tag I have no information about it. And also on default emptyview android project does not use/mention this feature. I know it is required by TV's and such but why its not added by default? Why is this? And Should I concern about it? android unity3d ...
Read more

WPF add header to Image with URL pettitions [duplicate]

Image
up vote 0 down vote favorite This question already has an answer here: Image source URI requiring authorization 3 answers Add header to all* HTTP requests on a machine 1 answer first of all sorry for my english. Recently I added some security in the backend of my project, and now I need to send a validation code(apiKey) inside the headers to retrieve the images. I have a problem with ALL images in my project that I had attached in my UI. For example, before I had: <Image Height="90" Source="{Binding Video.Thumbnail}"/> Now I need to change my code to create a CUSTOM petition add the apiKey in the header:...
Read more