asked on

ASP.net Active Directory Group Authentication

I am trying to lock it down a internal only website so only two Active Directory Security Group in our domain have access, and I cannot understand what I’m doing wrong. If the Active Directory User account is listed in one of the two Security Group the User gets access to the site and if the user is not listed in the group, they get routed to a custom Access Denied page. (Not the Windows Pop-up authentication box asking for the user ID and password) I guess I just don’t understand what I’m reading... (main thing is i don't want the windows pop-up) I'm very new to coding... I'm just a everyday Server/Exchange admin.

Any good examples someone can point me to? maybe a App_Start file, or something in the Global.asax

Details
IIS 8 windows 2012 server
Using ASP Master Pages if that helps

Site I have been reading
https://msdn.microsoft.com/en-us/library/ff647405.aspx

http://www.experts-exchange.com/Programming/Languages/Scripting/ASP/Q_21088059.html
http://forums.asp.net/t/1239052.aspx

ASKER CERTIFIED SOLUTION

Brian Murphy

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

POOK-101

ASKER

I'm going to test out the steps above, but I don't have access to change any IE settings. (Company policy locks them down) Any other way without having to worry about changing IE settings?

Brian Murphy

If they use corporate wide GPO then most likely they should have this set because a lot of internal sites use this same authentication.

To find out, open command prompt and type GPRESULT /H C:\TEMP\RESULTS.HTML

Open RESULTS.HTML

That is a verbose output of your GPO Settings.

POOK-101

ASKER

Okay... Automatic logon with current username and password (Is Enable) in our policy

Looks to be working (only testing with one account right now) but I'm still getting the popup.

The Provider is only Negotiate

Any ideas on redirecting users to a Access denied page?

POOK-101

ASKER

So found out that on the Production Farm, i can't edit the local NTFS permissions.

So i'm looking to a Code way in C# to do this.

Brian Murphy

Apologies, on the C# is that for a redirect or you looking for something that will "authenticate" users using LDAP versus Authenticated User?

Big Monty

I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.

POOK-101

ASKER

I ended up reading more about <security> settings with the Web.config in IIS. (took some time to understand it) but it works for me.

<security>
            <authorization>
                <remove users="*" roles="" verbs="" />
                <add accessType="Allow" roles="Domain\Team A " />
                <add accessType="Allow" roles="Domain\Team A " />
            </authorization>
</security>

Open in new window