Question

I’m creating an Intranet site in ASP.NET MVC 3 Beta and would like to use Windows Authentication exclusively. In addition, I’d like to use the Visual Studio Development Server in VS2010.

I modified the default web.config file to remove all references to forms authentication and switched to this:

<authentication mode="Windows"  />
<authorization>
  <deny users="?" />
</authorization>

However, when I launch my site and get the default page, I get this reply:

HTTP/1.1 302 Found
Server: ASP.NET Development Server/10.0.0.0
Date: Tue, 02 Nov 2010 14:05:19 GMT
X-AspNet-Version: 4.0.30319
Location: /Account/Login?ReturnUrl=%2f
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 145
Connection: Close

Which leads to this message in my browser:

Server Error in ‘/’ Application.

The resource cannot be found.

Description: HTTP 404. The resource
you are looking for (or one of its
dependencies) could have been removed,
had its name changed, or is
temporarily unavailable. Please
review the following URL and make sure
that it is spelled correctly.

Requested URL: /Account/Login

Version Information: Microsoft .NET
Framework Version:4.0.30319; ASP.NET
Version:4.0.30319.1 Version:4.0.30319.1

If I select the “NTLM Authentication” in the project properties under “Use Visual Studio Development Server” then I correctly get this reply on connect:

HTTP/1.1 401 Unauthorized Server
ASP.NET Development Server/10.0.0.0
Date: Tue, 02 Nov 2010 14:07:37 GMT
Content-Length: 1211 
WWW-Authenticate: NTLM

But then when I authenticate, I get the 302

I think this is just a matter of clearing out some default value but am not sure (“/Account/Login” doesn’t appear anywhere in my web.config files). If I remove the “deny” part then things work fine except that I don’t get an authenticated Principal and effectively remain anonymous.

I believe this used to work in ASP.NET MVC 2 and VS2008 by just changing the authentication mode to Windows, however it doesn’t seem to work that way any more.

I know I’m probably missing something basic. Thanks!

Note: This question is similar to the “Problem restricting anonymous access to an ASP.Net MVC Site” question, but different in that I want to exclusively use Windows authentication.

Answer 1

I had exactly the same problem. Turns out there was a change in MVC 3 (fairly well hidden, too) that has Forms authentication automatically enabled by default, in order to disable it add the following line to your root Web.config file, under the appSettings key…

<add key="autoFormsAuthentication" value="false" />

Hope that helps!