IIS Windows Authentication except for local machine

iiswindows-authentication

I have a PHP site (Default Web Site) and an ASP.NET site (application under the Default Web Site) running together.

I have set up Windows Authentication for the Default Web Site and it's fine. The problem is my ASP.NET application creates a web request – (HttpWebRequest)WebRequest.Create(url) – to pull in information from the PHP application. It's fine without authentication but with Windows Authentication it gets a (401) Unauthorized response.

I figured out I can pass credentials with request.Credentials = new NetworkCredentials(user, pwd, domain); but I'm really looking for a way for the PHP application allow the other application on the same server (site even) through.

How can I tell the Default Web Site to allow these requests?

Best Answer

I don't think you can bypass the IIS authentication. After all, this is what it is for :)

What you could do is setup the PHP website twice, once with authentication, and once without.

On the site without authentication, make sure you set IP Restrictions, to only allow localhost requests

Related Solutions

Security – Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5

Problem solved. I finally decided to compare the module list side-by-side and there actually was one missing. It turns out that there are two Windows Authentication modules:

Module List

On the server, the managed WindowsAuthentication module was there, but not the native WindowsAuthenticationModule highlighted above. Why it was configured that way is anyone's guess, but apparently if the native module is not loaded, the managed module will cheerfully load and silently fail.

So for any future readers who encounter this problem, make sure you have both modules loaded, because IIS will not warn you if one of them is missing.

IIS 7.5: How to configure custom Authentication Error page with Windows Authentication. 401 header problems

Try this:

change:

<error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="/not_restricted/401.htm" responseMode="ExecuteURL" />

<error statusCode="401" subStatusCode="2" prefixLanguageFilePath="" path="not_restricted\401.htm" responseMode="File" />

With the response mode 'File' IIS just loads the content of that file and displays it, it still sends the 401 status back to the client.

I used to use 'ExecuteURL' but have learned that File mode works much better. You just have to make sure that any linked resources in your error pages still work.

Best Answer

Related Solutions

Security – Troubleshooting Windows Authentication problems (no challenge) in IIS 7.5

IIS 7.5: How to configure custom Authentication Error page with Windows Authentication. 401 header problems

Related Topic