I'm trying to create a simple action filter for my MVC site that checks the current Windows user against those allowed access to the site. For some reason, the filterContext.HttpContext.User.Identity object is always set to anonymous with no username. I've tried to grab it at different stages (OnAuthenticate and OnAuthorize), but it's always anonymous.
I currently have anonymous and Windows authentication enabled in IIS (actually followed this example to configure the Windows Auth feature), and I have the following block in the system.web node of my web.config:
<authentication mode="Windows" />
<authorization>
<allow users="*" />
<deny users="?" />
</authorization>
However for some reason, the Identity is always anonymous with no username. I have to be missing something here. With Windows Auth set in IIS, I'm always prompted for the username/password combo (which actually fails with HTTP401.1 error 0xc000006d, though I think this might be because I have a custom host header setup for development). I've also read a few articles that suggest this is because my site is determined to be in the internet zone and the answers always state to add the site to the intranet zone in Internet Explorer. This seems like a band-aid fix though, and not the actual solution.
Ideally, I would like to have the following:
User browses to my site
Behind the scenes, their Windows username is picked up, and authenticated against allowed users managed by the app
User authenticated successfully, page loads, user is none the wiser they were authenticated
What do I need to do to achieve this?
Thanks in advance for any help. Please let me know if I can provide more context.
Edit: Forgot to add I'm running this on Windows 7 SP1, IIS 7.5
Try
<system.web>
<identity impersonate="true" />
</system.web>
OR
Click On The Project Not the Solution => Open Properties Explorer not right click properties => you will find Anonymous Authentication set to disabled
In your solution explorer, press F4 over the project, and change Windows Authentication to Enable if you are running your project from Visual Studio;
In IIS select your WebSite -> Authentication and Disable Anonymous Authentication and make sure that "Windows Authentication" if Enable
These two rules are in wrong order in your code
<allow users="*" />
<deny users="?" />
Since you first allow everyone, the second rule is not even evaluated.
Try switching them
<deny users="?" />
<allow users="*" />
This way you first deny anonymous requests so that the authentication pipeline can even return 401 to the client. When the NTLM/Kerberos authentication picks the username, the second rule allows everyone (authenticated this time).
For this to work you also have to disable the anonymous authentication.
You need to disable the anonymous authentication from iis and enable windows auth only.
Related
I'm trying to create a simple web form with windows authentication. I haven't done anything more than create the project. Like so -
When I hit f5 to view in browser, the pages load, though with no style like so..
As far as I'm concerned, it's meant to look like a nice bootstrap file.
Some things I've tried -
Update my web config
<location path="Content" allowOverride="true">
<system.web>
<authorization>
<allow users="*" />
</authorization>
<globalization culture="pt-BR" uiCulture="pt-BR" />
</system.web>
Made sure that the paths are correct (though I haven't touched anything since making the project).
Any help is greatly appreciated!
EDIT:
I've created another project - and the only difference between this one and the one above is that there is no authentication. When I load the about page, the style loads as seen below -
Should also mention that this is a Visual Studio 2015 project...
I had the same issue. CSS was not loading when I enable Windows authentication.
The error code in iis log was 500 0 1346.
This was resolved after adding the application pool identity to the administrators group. Basically, the application pool identity must have "impersonate a client after authentication" policy. So adding it to a group with this policy should fix.
Article - https://blogs.msdn.microsoft.com/asgoyal/2012/08/25/one-thing-you-must-do-when-getting-http-500-0-1346-error/
trying to do something really basic!
I have an MVC5 Web app - and I want to make it work as an intranet app. I had a look at https://msdn.microsoft.com/en-us/library/gg703322(VS.98).aspx and it seems straightforward . I want to things a little different though .. I want to control access by roles in a global way .. I would have thought through web.config.
<system.web>
<authentication mode="Windows" />
<authorization>
<allow users="*" />
</authorization>
So - we have 2 servers , 1 Domain Controller SBS2008 and 1 web server Windows 2012 server which is connected to the SBS domain .
1) I can log on to app ok if I am a domain administrator
2) I can deny myself access using those settings in web.config.
The problem is whenever a standard user tries to go to the site they are asked for a user name and password. Help!
One other thing - I can't enable impersonation or I get Error 500 .
I have an ASP.NET MVC4 website deployed on IIS with Windows Authentication enabled. My config file has this setting:
<authentication mode="Windows" />
<authorization>
<deny users="?" />
</authorization>
My understanding is that this will allow me to authenticate without having to type in credentials; i.e. an intranet site.
This works as intended, except for the first page load. When I first access the website, I am directed to the following URL:
http://localhost/SandboxWebsite/login.aspx?ReturnUrl=%2fSandboxWebsite
This is obviously a page that asks for credentials. When I then navigate again to http://localhost/SandboxWebsite/, I am automatically authenticated without having to enter any credentials.
Why is this occurring and how can I prevent it?
The problem was that, whilst anonymous access was disabled as a setting, there was no authorisation rule to deny anonymous users. Why this redirected me to Login.aspx I do not know, but I fixed it by adding the following rules.
IIS > MyWebsite > .NET Authorization Rules
John,
this is a long shot but have you tried using an address other than LocalHost to access the site ? It may be that your ASP.NET MVC4 website is expecting a specific domain name/computer name or IP address because of the way it was setup.
You could alter your hosts file to test this out.
Hope this helps.
Dorje
Here's my scenario:
I have an intranet application. I want to let the network users automatically get logged into the application using the Windows Authentication features. If the user isn't into my network, I'll pop up to them a login screen.
So, I changed the authentication mode into web.config file to Windows. Then I'm using the HttpContext.User.Identity object in order to get the logged user into the network. So I ran the app into my localhost and it works great.
When I publish the application into the server, when I try to automatic log in, the Identity object is always empty.
So, I've tried the following steps:
Deny anonymous users. <deny users="?"/>, which not allows any anonymous users to enter in the application, but I got a problem here: when the user isn't into our network, the server pops up that default authentication window from Window Servers, not my personal login screen.
Let anonymous users in. If I get rid with that <deny users="?"/>, any user can access the page, but it ALWAYS goes to the login screen, even if I'm into my local network.
So, what I need is: when the user is into the local network, go straight without login. If they aren't, pop up a login screen to them.
Can someone help me to figure out what's going on?
Thank you all!
Do the following,
<identity impersonate="true" />
<authentication mode="None" />
<authorization>
<deny users="?" />
</authorization>
Hope it helps.
I have an asp.net site, and I need to use both Windows Auth and Anonymous Auth together.
I need Windows auth as I need to get the username of the logged on user, but also the site runs a web-service which must be accessed anonymously.
If I turn on Windows Auth I can get the user and this works fine, but the site calling the web-service returns a 401 error. If I add in Anonymous access too the site using the web-service works fine, but I can no longer get the username of the logged in user.
How can I get the best of both - i.e. get the user name, but not kill my web service.
You can add the following to disable access to specific locations within your directory tree
<location path="path.to.web.service">
<system.web>
<authorization>
<allow users="*"/>
</authorization>
</system.web>
</location>
while keeping the main site under control of the Windows authentication.
See : http://msdn.microsoft.com/en-us/library/b6x6shw7.aspx