web site configuration

Question

One web site is required to be accessed by me (developer) and one user (DOMAIN_NAME\USER_NAME).

When I developed web site in visual studio using "automatic host" created by VS, the following settings in web.config were enough:

<authentication mode="Windows"/>
<authorization>
  <allow users="DOMAIN_NAME\my_name,DOMAIN_NAME\USER_NAME" />
  <deny users="*" />
</authorization>

But when I created web site in IIS I'm receiving error:

Access is denied.

Description: An error occurred while accessing the resources required to serve this request. The server may not be configured for access to the requested URL.

Error message 401.2.: Unauthorized: Logon failed due to server configuration. Verify that you have permission to view this directory or page based on the credentials you supplied and the authentication methods enabled on the Web server. Contact the Web server's administrator for additional assistance.

What setting for ApplicationPoolIdentity and web site itself are required to be specified?

Thanks a lot!

EDIT:

I've configured Application Pool of local IIS to use 'LocalSystem' identity, web site - to use "pass-through" authentication, and as suggested disabled "Anonymous Authentication", enabled "Windows Authentication" - and web site locally became workable.

But locally I have windows 7 (IIS7), but on "TEST" environment (where I need to deploy web site) I have windows 2008 server and it doesn't have option to enable "Windows Authentication"... don't know why... probably that is for higher level of administrator, but I'm a member of Administrators group...

Guess, I'm doing something wrong...

Please advise.

Answer 1

Your web.config is set up properly. Further, ensure the IIS site/app is configured as:

• to NOT allow anonymous access
• forcing Integrated Windows authentication
• leave the app pool as Network Service

IIS7

• ensure you have the Windows Authentication security feature installed in Roles & Features.
• In IIS7, go to the IIS or Features View, double-click Authentication.
• On the Authentication page, select Windows Authentication
• On the Authentication page, disable Anonymous Authentication
• MSDN article

IIS6

Find the dialog below at

• Control Panel / Administrative Tools -> IIS Manager -> Right click Web site -> Properties -> Directory Security

Answer 2

Maybe it can be useful: I started to receive 401.2. error in .ASPX application (no changes in the app made), in protected path amd Forms auth.:

<authentication mode="Forms">
...
</authentication>
...
<location path="Admin">
    <system.web>
        <authorization>
            <allow roles="Admin,Client" />
            <deny users="*" />
        </authorization>
    </system.web>
</location>

AFTER launching of other MVC applications on same computer/IIS. It seems MVC changed something in server's config (routes, I believe). Any playing with Authentication in IIS (computer/server/site) did not help. But Next helped: I have changed Application pool from .Net 4.5 to .Net 4.5 Classic for the web application. The difference in pool Managed pipeline mode, Integrated/Classic.