Configure Web app for external access (IIS7), allowing only certain users via AD group. All users need internal access

active-directoryiis-7remote-accesswindows-server-2008-r2

We have a Web app running in IIS7 (Server 2008 R2). I now need to allow external access with an SSL certificate, so certain users (e.g. the owner of the company) can use it remotely without VPN. They want to roll out the external access only to those specific users at first (thinking: a Windows credential prompt), BUT everyone will still need access internally (HTTP), without the prompt.

I have the SSL cert installed on the server and public DNS configured. I've been trying to figure out how to work the authentication/authorization. I was thinking I need to disable Anonymous authn and set Windows authn, then I keep coming back to 'URL Authorization' in my research for the group setting; however, when I tried URL authz, (removed allow all, added allow rule for the special group), it broke the site internally (403.2 Forbidden, I believe it was). I thought maybe setting up a second site in IIS pointing to the same program would work, but the exact same thing happened (and again with a new app pool, just for kicks).

So I guess my question is, how would you do this: allow external access, limited to users in a specific AD group, while still allowing internal access without a credentials prompt?

How do I separate the external HTTPS and internal HTTP authorization requirements? Will I need to just copy the entire contents of the app in Windows Explorer to a new folder and create my external site from that? Is Windows authentication the correct option for this?

I did come across this, which refers to creating a custom module. While it sounds like a solution, it's not one I'm familiar with, and I just wondered if there is a simpler way to get it to work: http://forums.iis.net/p/1182792/2000775.aspx

Thanks!

Best Answer

Is Windows Authentication the correct option for this?

  • Yes, it sounds like Integrated Windows Authentication is appropriate for your requirements.
  • You won't need a password to login if it is configured correctly.
  • Essentially the browser will pass the credentials to IIS but will fallback on password authentication as last resort when trying to authenticate the user.

This should give you a good start in Understanding IIS Authentication.

  • Regarding your prior 403.2 problems, you probably needed to examine file permissions in relation to the user that authenticated.
  • Take a look at: Pass-through Authentication
  • Remember that Windows Authentication means the windows user on the client-side is the user authenticated through to the server.

To limit access to a particular group in AD only for the external access:

Related Topic