I am trying to setup a local Sharepoint Server 2010 for testing purposes. I have never worked wih SP before, but it is per request from a client. And I am a strong fan of "learning-by-doing".
Everything is setup fine but when I try to access the Central Administration site it keeps asking me for user and password and I have no idea what that is. Is there something I am missing somewhere or forgot to set up. I have enable anonymous login in the IIS settings but that doesn't seem to make any difference.
I am logged in with my standard Windows user "Morten".
are you using Domail Controller Active directory user to login ?
IF yes then check that your PC is available in Domain Controller
also check ,
Go to IIS > Your SIte > Right click on your site and go to advanced settings > Check for the Idenetiy under Process Model Section .
It should same as your login.
Let me know the outcome
Related
I've got a web app that runs on a machine and should only be used if a particular user is logged on to that machine. so in page_load I have the following code:
dim sName as string = System.Windows.Forms.SystemInformation.UserName
if sName <> 'sstation' then
Response.Direct("NoAccess.aspx")
end if
this works perfectly when I am in Visual Studio debugging, if I am logged on to the computer as sstation, the page loads up, if not it loads the NoAccess page. However, if I open the page in a web browser, it always takes me to the NoAccess page and I can't figure out why! Any ideas
I've added a text box to the page and added this code:
lblErrorMessage.Text = "You are logged in as " + sADname
and the name comes up as Administrator even though I am logged on to the machine as sstation, so where does System.Windows.Forms.SystemInformation.UserName come from when the page is on a server?
This code is running on the web server, NOT the machine that the user is logged in to. It will return the user account that IIS is running as. The reason it works on your local machine when debugging is that the web server is running on your local machine in that case. This account can be configured in the App Pool that the IIS site is set to use. See this link for more information on configuring it.
In order to get the user account of the client machine in IIS, IIS will have to be configured for Windows authentication, and both the client and server will most likely need to be part of a Domain. If that isn't possible you will need to use some other kind of authentication, the easiest being Forms authentication, or ASP.NET Identity.
Here are some links to get you started.
ASP.NET Identity
Forms Authentication
Windows Authentication
I am using joomla 3.0 and i want to when user open joomla 3.0 site then first open only login page then after login he can access website.
Thanks For Advance
You can put the site in offline mode.
So the site will display the login page.
Remember to grant permissions to the users to access the offline site!
If you want to "protect" the whole site with login the best option is to turn the site off and then the user will need to login after opening the intranet page. Its probably the cleanest way how to to it without modules/plugins.
As we are doing it in my company (we are also running intranet on Joomla!) is, that all the articles are set to registred and the landing page of intranet just contain warm welcome and login form.
One thing to mention: Forcing this login for viewing some article/other content is not secure at all, mostly the local instalation will run on database with root access without pass (default setting) and with unecrypted database easily accessible. This is something to consider. If you are running this intranet in small company with loyal employees or without sensitive information you should be fine if not you should put more stress on the security issues.
I have an ASP.NET MVC 3 web site that uses Windows Authentication running under IIS7.5. This web site also checks manually for groups in AD using the GetRolesForUser method of a custom RoleProvider. This isn't anything special, and has been working fine for a few months now.
However, we now have a user that had their Active Directory user name changed. They still have the same actual AD account, but to them their login name is now different.
Unfortunately this has broken the web site for this user. I'm using Elmah to log errors, and I have noticed that REMOTE_USER is using the old account name, and LOGON_USER is using the new account name. It looks like the username parameter of the GetRolesForUser method is getting the old account name - so I assume it is using REMOTE_USER.
Should I be targeting the web server or the web site for a fix? I've read that LOGON_USER and REMOTE_USER are only different if there is an authentication filter installed. I'm not aware of anything like this on the web server (although I'm not sure exactly where to look), but does MVC3 add this somehow?
Typical, after I posted, my Google-Fu kicked in.
Seems like this is a known issue (by design) with the local sid cache:
http://support.microsoft.com/kb/946358
Resolution is to follow the registry change in article (and undo it again?), or reboot the web server. I have read that a IISRESET might fix this too.
I have made an ASP.NET MVC 3 Intranet site with Windows Authentication enabled:
in the Visual Studio project file properties
in the web.config, i.e. <authentication mode="Windows"/>
on the site properties in the IIS 7.5. server
Anonymous access is disabled for all these three above, the web.config says <deny users="?"/>. Impersonation is disabled in the web.config by identity <impersonate="false"/> and on the site properties in the IIS 7.5 server. And finally, the NETWORK SERVICE is set to run the app pool and also has Read on the site folder (not sure if it's needed though, you tell me, but it sure ain't enough to solve my problem below).
Now, when logging in through the standard Windows Authentication dialog box, domain users are presented with a 401.3 error after three valid login attempts. This seems to be before even reaching my MVC site's code, i.e. it seems completely IIS related. The event log gives the following kind of entry (it's an Information entry, not an Error, and I've obfuscated it a bit to protect my client) for all the users that has tried to log in:
Event code: 4008
Event message: File authorization failed for the request.
Event time: 2012-02-20 18:45:41
Event time (UTC): 2012-02-20 17:45:41
Event ID: 6dd3b4bf99784ba1a0fe06694dd89691
Event sequence: 3
Event occurrence: 1
Event detail code: 0
Application information:
Application domain: /LM/W3SVC/2/ROOT-1-129742335229554599
Trust level: Full
Application Virtual Path: /
Application Path: D:\Public\BlahblahManager\
Machine name: HUB01-XYZ123
Process information:
Process ID: 2920
Process name: w3wp.exe
Account name: NT AUTHORITY\NETWORK SERVICE
Request information:
Request URL: http://blahblahmanager.user.ad.blah.com/
Request path: /
User host address: 134.XXX.XXX.XXX
User: USER-AD\teh-user
Is authenticated: True
Authentication Type: Negotiate
Thread account name: NT AUTHORITY\NETWORK SERVICE
Custom event details:
It is only when I specifically grant USER-AD\teh-user or USER-AD\Domain users the Read permission on the site's root folder (D:\Public\BlahblahManager) that the user can log in and actually see the site.
Why is this? There must be some kind of configuration that I'm missing. Shouldn't it be enough that the NETWORK SERVICE has Read on the site's root folder? I've Googled this for a while, and impersonation is mentioned here and there, but the jury is still out it seems. Some sites claims that you should go with impersonation and they provide examples on how to do it, but when I try out the examples it still doesn't work. Other sites says that impersonation is NOT the way to go and that you NEED to grant the folder permissions in these cases. But that seems such an odd thing to do. Users have no business on the actual server, they should be working through the website only.
Any suggestions? What is usually the minimum amount of configuration needed to get this to work? Any tips on how to troubleshoot this kind of problem and get to the root cause?
I refer you to see this post that declares all of MVC authentication methods. but make sure you have enabled minimum required authentication on your mvc application. Notice that Anonymous Authentication works with your group policies. you can config that by following : Internet Options -> Security Tab -> Local Intranet -> Custom Level, on your browser.
1- Another thing that may causes the problem is IIS may configured not to authorized related users. Some of them are :
iisservice
IUSR
IIS_IUSRS
Network Service
2- Also Check allowed verbs in IIS.
3- On the root folder of your application Give read access to IIS AppPool\YourAppPool.
4- Another cause could be hierarchical access rules in your application depends on what application services you are using, like web site panel access rules.
5- Setting the clientaccesspolicy.xml file.
6- Check InitializeService() Method, do you set entity access rules properly? For example:
config.SetEntitySetAccessRule("*", EntitySetRights.All);
7- Check FileAuthentication module at the web site level.
Double check Anonymous authentication is enabled on IIS.
Also, have a look at this post.
We were also fighting with this issue, and started setting up security groups so we could give our users file level permissions. Then one of our server admins stumbled across a couple of new properties that allow the app to authenticate to the file system under set credentials, and resolved the need for the users to have access. Here is what he came up with…
There are two IIS settings that control this:
Physical Path Credentials Physical Path Credentials Logon type
By default, Physical Path Credentials is set to Application User
(Pass-through authentication). This means that IIS doesn’t do any
impersonation when handling Windows Authentication requests. This can,
however, be set to a specific user (though not, unfortunately, the
application pool identity, which would be ideal). Physical Path
Credentials Logon Type is set by default to Clear-Text. For my testing
I set this to Interactive (though this may not be the correct value).
Possible values are Clear-Text, Batch, Interactive, and Network.
To set this up I did the following:
Created a local account (IIS-AccessUser)
Granted IIS-AccessUser read and execute access to the /home directory of the site.
Added IIS-AccessUser to IIS_IUSRS group (necessary for accessing .NET temporary files)
Set IIS-AccessUser as the Physical Path Credentials
Set Physical Path Credentials Logon Type to Interactive
Doing the above allowed me to log in to the application directly,
without having to allow Authenticated Users, or me having to be a
member of any of the groups in the /home folder. It also still
preserved .NET Authorization roles, so I still could not access parts
of the site that I was not allowed to.
I also faced this same issue on iis7 with windows authentication, but with with MVC4.
Finally found this post. Hope this might help someone in the future.
You are not required to grant file access permissions when using Windows Authentication in IIS 7.0 and IIS 7.5.
There's a better way that we were only able to discover this because our server admin smelled the security and management issues that arise from taking the route of granting file level access to users and groups.
For anyone dealing with this issue or if you are setting up a new IIS7/IIS7.5 server and/or moving from IIS 6, here is an article that gives you all of the Windows Authentication options and configurations that need to be modified to avoid granting file level access to individuals or groups.
Please read the two comments in at the end of the POST for some valid critiques of the methods used in this article.
http://weblogs.asp.net/owscott/iis-using-windows-authentication-with-minimal-permissions-granted-to-disk
In addition to the information in the article, please be aware that IIS 7.5 is not using the web configuration tags for system.web (at least not in my MVC 4 application).
It is looking in the system.webserver tags for authorization configuration (where you will need to list the windows domain\groups a user needs to be in to access your application).
-- DSB
Basically, all I did was redirect an old website in IIS management to a new local directory, and now all the pages suddenly require the HTTP authentication. I have checked the settings, and Enable Anonymous Access is checked, and lists a guest user. I then tried creating a new local user, making it guest-group member only, and entered that into the website IIS settings to use.
Still no luck. Why does IIS suddenly want authentication? What changed??
Check the permissions on the directory to ensure that the user Internet Guest Account has read access.
Check account under which apppool is running. Does it have access on website folder?