ASP.NET Web.config authentication/authorization settings

Question

I'm trying to configure the IIS Authentication settings from my MVC5 project in the Web.config file.

Here's what I have. I want Windows Authentication enabled and Anonymous Authentication disabled.

But after publishing my package in IIS, the settings are this.

What do I need to do to also set the Anonymous Authentication to Disabled in the Web.config? Isn't that what <deny users "?"/> is supposed to be doing?

Answer 1

Here we go step by step:

1. Open Internet Information Services (IIS) Manager:

   • If you are using Windows Server 2012 or Windows Server 2012 R2:
   • On the taskbar, click Server Manager, click Tools, and then click Internet Information Services (IIS) Manager.
   • If you are using Windows 8 or Windows 8.1:
   • Hold down the Windows key, press the letter X, and then click Control Panel. Click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.
   • If you are using Windows Server 2008 or Windows Server 2008 R2:

   • On the taskbar, click Start, point to Administrative Tools, and then click

     Internet Information Services (IIS) Manager.

   • If you are using Windows Vista or Windows 7:

   • On the taskbar, click Start, and then click Control Panel.

   • Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.

     2. In the Connections pane, expand the server name, expand Sites, and go to the level in the hierarchy pane that you want to configure, and then click the Web site or Web application.
     3. Scroll to the Security section in the Home pane, and then double-click Authentication. 4.In the Authentication pane, select Anonymous Authentication, and then click Disable in the Actions pane.

Or you can disable by config file:

<location path="Contoso">
   <system.webServer>
      <security>
         <authentication>
            <anonymousAuthentication enabled="false" />   <!--This line you need-->
            <basicAuthentication enabled="true" defaultLogonDomain="Contoso" />
            <windowsAuthentication enabled="true" />
          </authentication>
      </security>
   </system.webServer>
</location>

Deny Anonymous user to access entire website:

   <authorization>
    <deny users="?" ></deny>    
    </authorization>

Hope it helps;)