Home / server / Questions / 79034
In Process
Boris Guéry
Asked: 2009-10-29 02:03:22 +0800 CST

How to simulate htaccess for auth with IIS without having access to the server config?

  • 772

I need to put a website on windows server IIS, i'd like to use basic authentification like i'd do with Apache, with the .htaccess / .htpasswd

I read here & there, that i could do this through the admin tabs of IIS, but i'm not the administrator, and i only have ftp access. It seems to be a 'web.config' file where i could do this.

Is there a way to set up such things within a config file ?

I'm not used to work with IIS...

iis

2 Answers

  1. This depends. Typically this isn't delegated the same way as Apache does. However if you are looking to password protect your site and you're using ASP.NET, you can do this with the authentication and authorization elements. This is set in web.config. To research and get up to speed, do a google/bing search for "authentication authorization asp.net".

    Additionally, if you are using IIS7, then you can set this in <system.webServer> which will apply to all file types.

    If you need to change the authentication type from windows to basic, that's something different again, and will require the server administrator or a control panel to help with that, but I suspect that it's just password protection that you need.

    Here's an example that may be what you need:

    Assuming that you're using asp.net and you want to password protect your site, create a file called web.config in the root of the site and place the following in it:

    <configuration>
  <system.web>
    <authentication mode="Windows">
    <authorization>
      <allow users="?" />
    </authorization>
  </system.web>
</configuration>
    • 1

  2. Wouldn't Scott's method work regardless of if the app is ASP.NET or not? IIS will be looking for a web.config to override its defaults anyway and it likely wouldn't care what type of content you're serving until after that. There's nothing in the code that is required to implement that web.config - it's just telling IIS what you want done on the authentication/authorization level.

    • 0