IIS7 Mixed Mode Authentication

Question

We're getting ready to start migrating some of our IIS6 sites to IIS7, and the application currently uses Forms Authentication. We have started getting some requests from various sites to use the Windows Authentication for the users. While this is easy enough to implement (and I've shown internally that there is no issue with the app, as expected) the question then is how to continue to keep Forms authentication for when Integrated Windows doesn't work. I've seen several walkthroughs on how to have it configured on IIS6, and I could do the same thing on IIS7, but then I have to turn on Classic Mode processing. Any solution should also be back portable to IIS6, if possible, to keep the build tree simple.

So what are my options on this? Do I setup the app with Integrated Windows Authentication in IIS7, Forms Auth in the web.config, and redirect 401 errors to an "error page" allowing them to login using forms, then back to the regular app?

The case when Forms is likely to be needed is going to be reserved for Contract workers, our support staff, and if someone needs to access it on their site from their Extranet. So primarily it's for our staff to login to check functionality and confirm bug reports. I suggested we just maintain that for our support staff to work, we need a Windows login that will always be live, and then we'll just enforce local responsibility on who can login to the site, but I'm told that we would do better to have Forms Authentication.

Any thoughts? I can post some of the links of the articles I've already read through if that would help the forum better narrow my needs.

Many thanks.

tl;dr: How to do mixed mode authentication (forms, windows) in IIS7 without changing to classic pipeline and still be able to use the build in IIS6 if possible.

Answer 1

which way did you go? Im looking at the same technique

Answer 2

thanks for getting back to me, I have been playing round with several of the implementations on and off for a few weeks now, that I've read about on the internet (javascript, 401, 2 virtual directories) but still havnt really found anything that works as I wanted. We will be potentially rolling it out to more than one client-each with different hardware/setups even different versions of iis, so wanted it to be as generic as possible. Ive come up against a brick wall on a couple of the suggested solutions...

when you say for IIS7+ you removed ann access in web config, I assume like this: -

< location path="Authent/WinLogin.aspx" >

<system.webServer>
  <security>
    <authorization>
      <add accessType="Deny" users="?" />
    </authorization>
  </security>
</system.webServer>

< /location>

Answer 3

No, that's not quite right, but I can't do a code block in a comment reply, so I'll post a new answer ...

The following code block allows me to control anon access from IIS7 without having to muck about in the metabase (where GUI changes on IIS6 get applied)

<location path="WindowsLogin.aspx" >
    <system.web>
        <authorization>
            <deny users="?" />
            <allow users="*" />
        </authorization>
    </system.web>
    <system.webServer>
        <security>
            <authentication>
                <anonymousAuthentication enabled="false" />
                <windowsAuthentication enabled="true" />
            </authentication>
        </security>
    </system.webServer>
</location>

Answer 4

Worked like a proverbial dream, thanks drachenstern

Answer 5

Here's an article on two level authentication that might be of use on this subject.

Answer 6

Hey Drachenstern,

Your solution is working perfectly for me when I run it from in the debug mode of VS2008 (which is running on my actual webserver itself running IIS7).

However, once I try to run it straight from the IE broweser itslef, I get a 401.2 error (You are not authorized to view this page due to invalid authentication headers).

Are there any IIS setttings that I need to change in order for this to work? I currently have Annon=Enabled,ASP Impersonation=Enabled,Forms Auth=Enabled and Basic Auth=Disabled.

Your help is greatly appreciated as I have been searching for this solution for weeks.

Thanks Bart

Answer 7

@drachenstern: I'm trying to accomplish the same thing that's outlined here, I believe. I want valid Windows domain users to be automatically authenticated (no user/password popup dialog); and I want others taken to a forms auth login page (which I believe you've called Winlogin.aspx). I believe I understand why your snippet of Web.config would achieve the desired effect. However, the way this question thread evolved, the various instructions, tips, etc. are scattered around; and I'm not sure I have all the required information. Any chance you could collate all the steps into a tutorial. I'm thinking of:

• In IIS7 Manager, what are the required authentication settings for the web site?
• Does it matter if the asp.net app is a virtual directory (app) or the root of the web site?
• What does the <authentication> element within <system.web> look like?
• You outlined a <location> element for Winlogin.aspx? Any other location elements for pages and/or folders?
• What happens in Winlogin.aspx when accessed by an authenticated Windows user to skip the forms authentication and keep the user logged in (i.e. the typical forms auth ticket stuff?)?
• Anything else in the way of prerequisites, IIS and/or Web.config settings, or code that's required for this to work?

Thanks much,

Donnie

Answer 8

@drachenstern or @soccerdad perhaps I'm blind but did you guys ever create the tutorial you were talking about? If so could I get a copy to check it out I am using IIS7. BTW guys really cool thread.

Answer 9

@drachenstern

Tried to contact you over email, but no reply. So thought I would try here.

Any chance you could elaborate a bit more on how you did this. It's not very clear on your post which way you went.

So my question is.

1. Does all AD authenticated users have to hit the site using a special URL? Or
2. You send all users to the WindowsLogin.aspx and then if a 401 send them to the normal forms login page.

Thanks, Soeren