IIS7 - Password Protect Development Server

Question

Hi,

I have a development server running IIS 7.0 with an ASP.NET MVC Web Application, that authenticates using Forms Authentication/Membership.

I need to be able to prevent unauthorized users from viewing this site. Our customers however should be able to enter a simple username/password to gain access.

After they do so, they should be able to interact with the web application using Forms Authentication as if they just came to an unprotected site.

Any suggestions?

Answer 1

We wrote a custom module for IIS to allow certain IP ranges through automatically, and present anyone else with a login dialogue. Once they'd logged in, it stored that fact in their session and simply passed requests through.

Works alright, can be applied to anything in IIS sites or services.

Answer 2

My previous answer said forms auth and basic http auth could live side by side in II7 integrated mode. I was completely wrong and have since made a simple solution.

Using a custom HttpModule you can add basic auth along side regular forms auth

public class CustomBasicAuthHttpModule : IHttpModule
{
    private HttpApplication httpApplicationContext;

    public void Dispose()
    {
    }

    public void Init(HttpApplication context)
    {
        this.httpApplicationContext = context;
        context.BeginRequest += this.OnBeginRequest;
        context.EndRequest += this.OnEndRequest;
    }

    private void OnBeginRequest(object sender, EventArgs e)
    {
        // your logic of checking Auth header goes here
        if (this.httpApplicationContext.Request.Headers["Authorization"] != "Basic base64-encoded-user:pass")
        {
            this.httpApplicationContext.Response.StatusCode = 401;
            this.httpApplicationContext.Response.End();
        }
    }

    private void OnEndRequest(object sender, EventArgs e)
    {
        if (this.httpApplicationContext.Response.StatusCode == 401)
        {
            this.httpApplicationContext.Response.AddHeader("WWW-Authenticate", "Basic");
        }
    }

then in your web.config

  <system.webServer>
    <modules>
      <add name="CustomBasicAuthHttpModule" type="Namespace.CustomBasicAuthHttpModule, AssemblyName"/>
    </modules>
  </system.webServer>

Answer 3

I just did this with Helicon Ape. The free license includes 3 sites, which for me was good enough.

If you use this on a site, just remember to check if the license is activated for the site (start menu > helicon > ape > manager, help, license manager).

Answer 4

As Aaron points out, this isn't so straightforward in IIS7. Now, the flip side is this old trick is insecure at best and there are better ways to do it now and being able to use all authenticaiton methods with all apps has lots of advantages. There are some ways to get around this such as:

a) keeping the development site behind a VPN which your clients can access.
b) reverse proxying the site, and letting the proxy do the http authentication.
c) A bit more involved would be to build your app with a demo mode. Trick here is to make it turn on or off from the first request given a special magic query string. Check for that in Session_Start() then tag users that come with it and profit.