Restricting access to a website on IIS with groups

Question

I'm trying to set up our websites to only allow access from users in certain AD groups using windows authentication but i can't seem to make it work. I've tried using IIS's authorization and restricting it to those groups only, but i don't have access from users that are in those groups. This seems like something that's supported, but I can't get it to work.

The pages are completely in .net as well, so i've tried specifying

<identity impersonate="true"/>
<authentication mode="Windows" />
<authorization>
  <allow users="Domain\ProgramUsers"/>
  <deny users="?"/>
</authorization>

in the web.config but then it allows people in who aren't part of the Program Users group, which doesn't make a lot of sense to me.

score 1 · Answer 1 · answered Oct 17 '12 at 20:14

1

I think you need to specify:

Deny users="*"

At the moment you're blocking access only to non-authenticated users, i.e. regardless of group membership.

answered Oct 17 '12 at 20:14

darth_phoenixx

113
4

At that point i'm unable to access the site from either user. – Kravlin Oct 17 '12 at 20:22
Try including `` before the authorization node – darth_phoenixx Oct 17 '12 at 20:26
Already have it. I'll add that to the above information. Sorry about that. – Kravlin Oct 17 '12 at 20:27
Hmm.. ok. Couple of other things to try: check the case of your domain and group name - it believe the case needs to be correct e.g. ProgramUsers not programusers. Also, and forgive me this is not meant to be patronizing but is this definitely a security group and not a distribution group? – darth_phoenixx Oct 17 '12 at 20:47
Ah! Lightbulb moment. Try `` rather than `` – darth_phoenixx Oct 17 '12 at 20:51

score 0 · Answer 2 · answered Nov 19 '14 at 17:48

Try using <allow roles="domain\group"/> instead of <allow users="domain\group"/> like mikrose suggested. It's how we have it setup on some of our internal sites and it seems to be working for us along with the <deny users="*"/> and we do not have impersonate explicitly set.

Restricting access to a website on IIS with groups

2 Answers2