Question

I am trying to setup windows authentication on a MVC 2.0 app. Everything is in config, and for now I basically just want to allow authenticated users and reject anonymous users:

<authentication mode="Windows" />

<authorization>
  <deny users="?"/>
  <allow users="*"/>
</authorization>

On the IIS web site I have disabled all other authentication types but windows authentication.

And now for the question:
When I set this up as an application under “Default web site” in IIS everything works as expected; users are prompted for credentials and authenticated against their accounts on the web server.

But when I create a new website on the same IIS root the authentication no longer works. Both the application and the website runs on the same box in the same app pool and are referencing the same physical location on the disk.

I am really out of ideas and would greatly appreciate any suggestions.

Answer 1

If you’ve set it up with a dummy hostname in the hosts file, then a security feature of IIS will be preventing the authentication from succeeding.

You may want to consult the following URL, which has instructions for adding a hostname to a whitelist, or for disabling that particular security feature:

The link is: http://support.microsoft.com/kb/896861