Basic and Forms Authentication with IIS in Integrated Pipeline mode

Question

0.00/5 (No votes)

See more:

My ASP.Net web site uses Forms Authentication to allow registered users to log into their account - protects the folder /account/.

For administrative (content management etc.) purposes we also have a /cms/ folder which is secured by basic authentication.

The rest of the site is publicly accessible with neither login.

We've been running IIS7 in Classic Pipeline mode and this setup has worked fine. However, we recently changed to Integrated Pipeline mode.

Since the change, the /cms/ section behaves strangely: when browsing to /cms/ the basic authentication prompt comes up as expected, and login works fine. Then navigating to any page within the /cms/ folder works fine too. However, if I directly browse to a different file within /cms/, for example I enter www.mysite.com/cms/mypage.aspx, then I get redirected to the Forms Authentication login page. After logging in as a registered user, I then get redirected back to the requested page in the /cms/ folder and then get the basic authentication prompt. Then, after entering the /cms/ login details, I get to the page I wanted.

Switching the Pipeline mode of the application pool back to Classic mode fixes the problem. I.e. keeps the two login methods separate. However, I'd prefer to be using Integrated mode.

Does anyone know of a way to get this to work in Integrated Pipeline mode?

The forms authentication section in my root web.config file looks like this:

XML

<authentication mode="Forms">
    <forms name=".formsauth" loginUrl="/login.aspx" protection="All" timeout="300" path="/"/>
</authentication>

And the web.config file in the /account/ folder (the one I'm protecting) looks like this:

XML

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
    <system.web>
        <authorization>
            <deny users="?" />
        </authorization>
    </system.web>
</configuration>

The /cms/ folder is setup to require HTTPS as well - but I don't think this affects my specific issue.

Posted 16-Dec-10 2:42am

Simon White

Add a Solution

Comments

Simon White 16-Dec-10 8:45am

Sorry, I forgot to say we're runninng ASP.Net version 4

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

TheyCallMeMrJames · Answer 1 · 2010-12-16T02:57:00

Solution 1

It looks like you might have to go through a little extra config. Does this[^] help?

Posted 16-Dec-10 2:57am

TheyCallMeMrJames

Comments

Simon White 16-Dec-10 9:08am

Thanks, but there's nothing in there about getting Forms Authentication and Basic Authentication to work on the same site.

TheyCallMeMrJames 16-Dec-10 9:32am

No, but there's info on getting Forms Auth running in integrated pipeline. Thought it might help. Cheers.

Simon White 16-Dec-10 13:37pm

The Forms Auth itself is working ok in integrated pipeline. It's the basic auth that's been giving me the headache - sending me via the forms auth login screen when I just want to log into the folder that's protected by basic auth.

When a registered user logs in using forms auth to access their account - that part works fine.

I've read around the web a bit more and it seems that Forms Auth and Basic Auth are incompatible on the same web site when using Integrated mode - so, for now I've switched back to Classic Pipeline mode.