Hello friends,

I would like to ask a question related with the authentication methods on IIS7. I hope this is the right place to ask this question.

Let me explain a few thing before asking my question:

- I am using Windows Server 2008 with IIS7 installed and working.
- Server is configured to run under Active Directory.
- I don't have any control panel software (and I am not planning to use because of financial problems).
- It is not possible for me to use Apache or any other webserver software due to maintanence problems.

Under these circumstances I want to use to password protect a directory and its sub-directories and only Administrators (or some other Organizational Units) of the Domain can access these folders like .htaccess system of Apache. As you know, Apache can authenticate using .htaccess along .htpassword file, LDAP, etc. When I looked at the IIS panel, I have found similar authentication methods, and then, I have succesfully installed Basic, Digest and Windows Authentication methods. I have tried these methods and I could not find a solution to my problem.

Sometimes password protection works; however, the protection does not cover sub-directories. Sometimes password protection doesn't work, even if I use the Administrator account of the domain. In any case, I couldn't manage to work password protection of a directory like in Apache model.

Is there any way, or tutorial on .htaccess-like authentication methods of IIS7; so, I can password protect a directory and its subfolders?

Thanks in advance :)

Hi,

Try this out if you are using .NET

http://learn.iis.net/page.aspx/377/using-aspnet-forms-authentication/

or

In IIS Double click Authorization Rules in the right pane > Click Add Deny Rule > In the pop up dialogue box, select All anonymous users > this will make some entries in web.config once you click ok

or checkout in Helicon Apps, they have applications for IIS7 password protection i think and you can check the trial version and try it out.

Thank you care4server. If possible, I don't want to use .NET, because I don't know how to program in .NET :D However, the link you provided seems good. If I couldn't find a solution, I have to use that. Thanks again for the link. :)

However, I think it is possible to use IIS admin panel to password protect directories and sub directories. When you click on the directory on IIS panel, you can see Authentication and Authorization Rules. I tried to play on these and I failed to setup password protection.

From these panels, you can specify users, authentication methods etc.; but, it seems these settings doesn't work for any Organizational Units or domain users. In some cases, combination of Basic Authentication and user spefication along "Authorization Rules" works, but not always. Sometimes it asks for a password, sometimes it doesn't. Additionally, basic authentication does not cover sub-directory protection.

Using Windows Authentication with user specification along "Authorization Rules" covers sub-directory protection; however, I couldn't manage to login with any domain user, even if specified in "Authorization Rules".

I think there is no way to achieve password protection using IIS panel. :(

Well, I have found what I want. I want to thank care4server again for the information.

As care4server said before, there is a Helicon application for Apache specialists, named as "Helicon Ape" and it is free for servers, hosting up to 3 websites.

For me, I am using a single website (with multi directories :)), that application is good for me.

Thanks again care4server :)

you are welcome mate

- I don't have any control panel software (and I am not planning to use because of financial problems).
Thanks in advance :)

You could try WebsitePanel control panel Free ASP.NET based control panel comes with complete sourcecode for you. You could customize as well. :-)
http://sourceforge.net/projects/websitepanel/

Thank you webhosting_domain :) I will give it a try :)

Password protection feature in Websitepanel works great if you configure correctly.