Like the title says, I want to protect a directory from anonymous access and that directory is ignored for routing because it contains static content.
I should also mention I'm just using the out of box individual accounts identity stuff in my MVC app.
The other catch I have is that I will be hosting as an Azure web app.
Ignore route looks like:
routes.IgnoreRoute("Cordova/{*pathInfo}");
That works just fine.
I thought I could just add a location exclusion in my web.config:
<location path="Cordova" >
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>
With just that, I can still access the content as an unauthenticated user, so that isn't it alone.
Then in the Web.config, system.webServer->modules section I added:
<remove name="UrlAuthorization" />
<add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />
Now it will deny access to the directory (when using the location element above), BUT it will not allow access to any authenticated user.
I saw a few other suggestions that involved tweaking IIS settings or local directory permissions, but since I'm hosting in Azure, that is not an option for me.
UPDATE
I implemented forms authentication in the web config, and manually added the FormsAuthentication calls in my Account controller. AND it works!
So I'm guessing the web.config deny="?" in the location element is only enforceable with forms auth??
Now I have the forms auth mixed in with the OWIN cookie auth stuff. I thought one used the other (what happened to app.UseFormsAuthentication?) but its not looking that way. I'm making a mess.
How should I be doing this?
UPDATE2
And in doing so now my WebAPI security is broken.
Related
I have recently started on developing an ASP.NET MVC web app which uses organizational authentication on Azure Active Directory.
I followed this tutorial: http://www.asp.net/identity/overview/getting-started/developing-aspnet-apps-with-windows-azure-active-directory
And I managed to deploy the application and it runs correctly.
However, I'm still unsure of the underlying working mechanism of the Federation WS used to provide the Active Directory organization authentication.
The application immediately redirects the users to the Microsoft login site when the website is run before rendering the home page. I could not find any piece of codes in the application that make this happen. I tried to comment out the IdentityConfig method in Global.asax but the redirection is still happening.
I would like to know when and how does the application start the authentication process and is it possible and safe to suppress the authentication process until the Sign In hyperlink is clicked by the user.
For adding AD authentication to ASP.NET WebApps/VNext you can use the new ADAL Library, there are many samples available here https://github.com/AzureADSamples. You can use this for example: https://github.com/AzureADSamples/WebApp-WSFederation-DotNet, this is completely driven by user actions.
I found out that the solution is pretty easy. Just remove:
<system.web>
<!-- remove/comment out
<authorization>
<deny users="?" />
</authorization>
-->
</system.web>
in Web.config. This will tell WSFederationAuthenticationModule not to execute the redirection event and allow anonymous users in public pages.
Apply [Authorize] attribute to the action or controller when authentication is needed if you are developing in ASP.NET MVC.
If you are developing in ASP.NET Web Form, add the following:
<configuration>
<!-- Add the following configuration-->
<location path="Admin">
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>
</configuration>
The above configuration will force the users to login Azure Active Directory in order to access the relative location path of 'Admin' in your web application (e.g. http://localhost:8080/Admin).
I am sure this has something to do with IIS but I can't figure it out.
I have a website using forms authentication. When my website tries to access any file resources (javascript files, css, etc), I am redirected to the forms login page set in my web.config. I also get redirected if I just type the address into the address bar.
The web.config entry for forms auth is pretty basic:
<authentication mode="Forms">
<forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>
There are also two location nodes to deny users from other parts of the site:
<location path="n2">
<system.web>
<authorization>
<allow roles="Editors" />
</authorization>
</system.web>
</location>
<location path="web.config">
<system.web>
<authorization>
<deny users="*" />
</authorization>
</system.web>
</location>
I am using the standard IIS7 install on Windows Server 2008 R2.
Edit
So, if I add a random auth cookie (FormsAuthentication.SetAuthCookie()), the resources become available, I know it has to be my authentication model that's messed up somehow. It works on another server (I just copied it over). Any ideas how I can track the problem down?
I had the same error, in my case the trick was setting Anonymous Authentication to use the App Pool identity instead of IUSR in IIS
Open IIS
Expand Sites
Select [YourWebSite]
Double click Authentication (will be under the IIS "Area" or the Security "Category")
Select Anonymous Authentication
Click Edit in the Actions pane
Click the 'Application pool identity' radio button
Don't use <location> tags in web.config to handle authorization in an ASP.NET MVC application as locations have no longer any sense. All you need in web.config is the authentication tag. In MVC authorization could be achieved by decorating proper controllers and/or actions with the [Authorize] attribute.
I use allow * for my Content folder. That will prevent any authorization from happening for static content.
<location path="Content">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
Rick
In IIS, my Anonymous Authentication was on correctly and the user was set to IUSR. Therefore, I needed to go into Windows Explorer, navigate to my web app directory, right-click for Properties, Security tab, Edit button, and give IUSR Read, List, and Read & Execute permissions (the default set). Ensure the changes will be inherited by all children, apply, possibly wait, and you're good to go.
It's been along time since I did any asp.net forms work but the first questions would be - are you sure your user is a member of the "Editors" role. You can use the Web Site Administration tool to set this up I think?
http://msdn.microsoft.com/en-us/library/ssa0wsyf.aspx
That is because you have set deny to everyone. In IIS 7, because of the integrated pipeline you will get redirected even when you try to browse CSS or any static page.
Put the static content inside a folder if you like and allow access to it.
I had exactly the same and found it was because I had forgotten to allow anonymous access to the website from inside IIS! This meant that the FormsAuthentication was always kicking in, even for the static resources that were not protected.
We're using Elmah as our error logging system for an app that will be going into production soon. It's extremely useful, but if it goes into production like this anyone in the world access the error log because all they have to do is visit ourdomain.com/elmah.axd.
This is obviously not ideal. I originally intended to restrict access to that page only to IP addresses within our company, but now our SysAdmins are saying that's not possible. So I'm asking here how can I prevent access to this resource?
We running an ASP.NET MVC app on IIS 6.
The typical scenario for securing elmah.axd is allowing only some authenticated user to be able to access it. But if your site doesn't use any authentication at all this might not be applicable.
Here's what I would recommend you:
Disable completely the elmah.axd handler on your main site
Configure elmah to write the logs to some shared data source (like a shared file, SQLite database or even SQL Server)
Configure a second site in IIS, probably on another network or server, which has only elmah installed and which points to this same shared data source. Now you would always use the second site to read the logs. Obviously the second site would only be accessible to you.
If you decide to use SQL Server you could even read the logs of multiple applications running on multiple web servers in a farm from within a single internal application accessible only to you.
I found this is most acceptable for MVC applications:
http://www.beletsky.net/2011/03/integrating-elmah-to-aspnet-mvc-in.html
You can point the elmah http handler to another url (for example "Secure/elmah.axd") in web.config. You can secure the url as any other asp.net page in the web config.
<httpHandlers>
...
<add verb="POST,GET,HEAD" path="/Secure/elmah.axd" type="Elmah.ErrorLogPageFactory, Elmah" />
</httpHandlers>
<location path="Secure" > <!-- secure the host.com/Secure path -->
<system.web>
<authorization>
<deny users="?" />
<!-- Or anything else... -->
</authorization>
</system.web>
</location>
We are successfully using this approach on IIS7 using active directory membership providers, and it works great. I am not sure if it works on IIS6 though.
If you're using ASP.NET Membership, it's pretty easy to restrict access to the elmah.axd HttpHandler for anonymous users and only allow logged in users in an "Administrators" group. I've done it like this:
<configuration>
...
<location path="elmah.axd">
<system.web>
<authorization>
<allow roles="Administrators"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
</configuration>
Anybody who's logged in AND member of the "Administrators" role can access the page now.
Here are some useful links:
Securely Implement ELMAH For Plug And Play Error Logging
Securing Error Log Pages
If your intention is to disable remote users from accessing it, simply change the value of <security allowRemoteAccess="yes" /> to <security allowRemoteAccess="no" />
I used IP Restrictions from the IIS 7 configuration. By default, you can't simply apply it in <location path="elmah.axd"> because it's locked on the parent configuration level. As such, I created an empty folder "logs" and applied restrictions in IIS to this folder, then modified the location path for the elmah.axd file. That's it! You have remote access to yourdomain.com/logs/elmah.axd, but only from specific IPs.
I am using MVC with forms authentication and i need authentication bypass for one of my controllers, is it possible to bypass authentication for Cotroller(s)/Action(s).
I have been through ASP.NET MVC Forms authentication and unauthenticated controller actions , but i dont want to restrict any action for a user/role , i want to allow it anonymously.
Can anyone help in this regard.
The location tag solution posted on the page you linked to actually does work for MVC. The authorization controls around that kick in before the MVC framework has a chance to handle the request:
<configuration>
<location path="~/MyAnonymousController">
<system.web>
<authorization>
<allow users="?"/>
</authorization>
</system.web>
</location>
</configuration>
Also note that you can put web.config files in sub-directories in your app. So for example, you can put your anonymous-access controller in it's own sub-directory and add a web.config in that directory with a location tag to allow anonymous access to everything in that directory: Web.config: Wildcards in location and authorization
Go through the following blog, it worked for me:
http://blog.tomasjansson.com/securing-your-asp-net-mvc-3-application
I have an asp.net MVC application that has one section /admin locked down via windows authentication. I have achieved this by doing the following.
Web.Config
<authentication mode="Windows" />
AdminController
[Authorize]
public class ContactController : Controller
{
....
}
This works as it should. When I try to access the /admin URI it prompts me for a windows login.
However, in my /Views/Admin/Index.aspx view, I am linking to two files:
<script src="/media/js/site.js"></script>
<style href="/media/css/styles.css" ... />
For some reason IIS is prompting me for a windows login for each of these files too.
If I hit cancel (after the first
login), then the page loads, but
without any CSS or Javascript.
If I
remove those tags from my view, then
I am only prompted to login one time
and it "works".
So why is windows prompting me to authenticate for the CSS & JS files?
Any help would be greatly appreciated.
SOLVED
As with most problems like this, turns out it was a permissions error.
I gave "Read" access on the media folder to the windows user that I was logging in with and bam it all works dandy now.
I know you've already closed your answer but I'll give you my 2/cents.
A better approach will be to authorize everyone to the media folder in the web.config:
<location path="media" allowOverride="false">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>
Also, specifying security in the web.config for other resources.