IIS ignores authorization in web.config

Question

I have a problem using windows authentication and the authorization-tag in web.config for my asp.net application. When I host the application in IIS (both in IIS 6 and IIS 7) the authorization-tag is ignored. When I run the application in asp.net development server that comes with visual studio 2010, it works perfect.

Why will it not work in IIS? And how to solve it?

    <system.web>
           <identity impersonate="true" />
           <authentication mode="Windows" />
           <authorization>
                <deny users="*"/>
           </authorization>       
    </system.web>

Answer 1

Without seeing the web.config it sounds like you haven't configured IIS. When you use Windows authentication what ASP.NET is expecting is for the web server to do the authentication - so you must configure it to do so, simply putting it in web.config is not enough.

For IIS6:

1. In IIS Manager, double-click the local computer; right-click the Web Sites folder, an individual Web site folder, a virtual directory, or a file; and then click Properties.
2. Click the Directory Security or File Security tab, and then, in the Authentication and access control section, click Edit.
3. In the Authenticated access section, select the Windows Integrated Authentication check box.
4. Click OK twice.

For IIS7:

1. Open IIS Manager and navigate to the level you want to manage. For information about opening IIS Manager, see Open IIS Manager (IIS 7). For information about navigating to locations in the UI, see Navigation in IIS Manager (IIS 7).
2. In Features View, double-click Authentication.
3. On the Authentication page, select Windows Authentication.
4. In the Actions pane, click Enable to use Windows authentication.