Why does my Windows authentication on MVC3 Intranet not work when publishing

Question

We have a simple intranet site in MVC3 and entity infrastructure. Everything works fine for debugging with visual studio. When I publish the site on my local IIS7.5 web server box or in the developer's block in the same domain, then I will be asked to enter a username and password, and it will not connect to the site. It simply returns error 401.1 and shows with curiosity

Logon Method Not yet determined Logon User Not yet determined 

I checked that Windows authentication is enabled and anonymous authentication is disabled. the application uses applicationPoolIdentity, but I tried it using network services without any differences. Webconfig includes

 <authentication mode="Windows" /> 

and I tried it with and without an authorization section.

 <authorization> <allow users="*" /> </authorization> 

The only other thing I found on the Internet is related to changing the registry entry, but ultimately it will be on the production server, so it’s not convenient for me to make registry changes just for that.

executed locally with this code block, returns all expected information

 <div id="title"> <h4> Environment.UserName: @Environment.UserName @DateTime.Now.Millisecond.ToString() </h4> @foreach (var role in Roles.GetRolesForUser()) { role.ToString(); <br /> } </div> <div id="logindisplay"> Context.User.Identity.Name <strong>@Context.User.Identity.Name</strong>!<br /> @Environment.UserDomainName </div> 

This is an MVC3 web application. IIS authentication switches are

 Anonymous Authentication Disabled ASP.NET Impersonation Disabled Forms Authentication Disabled Windows Authentication Enabled 

Any other ideas or things that I am missing?

Answer 1

This MSDN article shows how to set up the IIS 7 MVC3 Intranet website: http://msdn.microsoft.com/en-us/library/gg703322(VS.98).aspx

An interesting snippet that applies to you is most likely the last section on avatar. If you run your site under Windows Authentication, but you have Impersonation, you will read / execute files for the website using an authenticated identifier. This means that each user who wants to access the site will need access rights to the folder / file.

To avoid this, use Windows Auth so that users can authenticate, but use impersonation to use a single identifier to access the folder / files.

Answer 2

It seems that you are working with Windows authentication, since you need to provide credentials when you open the page ... you have to put your credentials there and it should go to your web page ... or the problem is that you are not failed to open the page after entering the correct credentials?

First of all, I will try to change the application pool mode from Classic to Integrated (or vice versa).

Then it looks like your computers are in some kind of domain? In this case, make sure that you set the correct credentials. You should put <domain>\<your_username> as the username. Also, if this does not work, try adding and removing your computer from the domain and try again. Maybe there are more ideas, let me know how this happens, and if possible, what is the output of the nltest.exe /SC_QUERY:domain_name ?

Answer 3

You need to configure this in IIS to use Windows Authentication.

• Open IIS Manager
• Go to where your application is in IIS
• In the content view, double-click Authentication
• Enable Windows Authentication and Disable Anonymous Authentication

If you do this only in AppPool, application settings override this.

When you speak:

I have verified that Windows authentication is enabled and anonymous authentication is disabled.

Where exactly did you install it? You do not know which OS you are running on the machine, where you will receive the request, but some variants of Windows do not support Windows authentication (that is, Windows 7 Home does not work).

Answer 4

I have the same problem. When creating a new application on websites by default, everything works fine. But when I create a new site and put the files there, I can not make it work. I continue to receive an invitation to enter. I use the same application pool for my new site and have configured directory permissions to allow full control over iis_isuser and others, since it is a dev machine.