I have a problem with certain clients being able to access a protected area
of our website. We're using IIS6 and have a folder set with security
properties that deny access to iusr_win2003.

For all but a few clients, the login dialog appears when they try to access
a page that is in the folder. Some clients get 401.3 error without the login
dialog ever appearing. What gives? Does anyone know what browser settings
may be getting in the way for these users?

-Phil Sherwood

Answer depends on your IIS security settings as well as the client's
auto-login settings.

If you want to deny anonymous access, then just uncheck the "Anonymous
authentication". Setting deny ACLs simply prevents anonymous authentication
from working *even if* you check the "Anonymous authentication" elsewhere --
this is usually unexpected behavior.

Read the following blog entries for info on how authentication works on IIS
as well as how to diagnose issues:
http://blogs.msdn.com/david.wang/archive/2005/07/14/HOWTO_Diagnose_IIS_401_Access_Denied.aspx
http://blogs.msdn.com/david.wang/archive/2005/07/04/Why_you_get_login_prompt_on_VS2005_with_Integrated_Auth.aspx
http://blogs.msdn.com/david.wang/archive/2005/06/29/IIS_User_Identity_to_Run_Code_Part_2.aspx
http://blogs.msdn.com/david.wang/archive/2005/05/26/IIS_User_Identity_to_Run_Code.aspx

--
//David
IIS
http://blogs.msdn.com/David.Wang
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
I have a problem with certain clients being able to access a protected area
of our website. We're using IIS6 and have a folder set with security
properties that deny access to iusr_win2003.

For all but a few clients, the login dialog appears when they try to access
a page that is in the folder. Some clients get 401.3 error without the
login
dialog ever appearing. What gives? Does anyone know what browser settings
may be getting in the way for these users?

-Phil Sherwood
SherWare, Inc.