Groups | Blog | Home
all groups > iis security > january 2004 >

iis security : Redirecting to custom .aspx error page?



swheatley22 NO[at]SPAM yahoo.com
1/20/2004 12:19:15 PM
I found the following posting,
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=utf-8&selm=Rnw8J81PCHA.1712%40cpmsftngxa07

which loosely explains how to do a joint NTLM/Passport authenticated
site, with a database for roles. I have been able to modify this
slightly to work for my own form authentication (actually using
<authentication="None"> though) Basically I have to manage a cookie
or session object that lets the system know the user is logged in.

I'm trying to follow the example in 5A of that posting. It has an
NTLM authenticated page which errors out to a form for logging in if
the user can't authenticate. Thus, the entire site has no .NET
managed authentication, and all but this one NTLM authenticated page
are anonymous.

Example:
ntlm.aspx - NTLM authenticated, if not, redirect to
forms.aspx
forms.aspx - form, anonymous access
Page3.aspx - once authenticated go here
anyotherpage.aspx - redirect to ntlm.aspx if not authenticated.

The problem is that whenever the ntlm.aspx fails authenticating, it
can't successfully redirect to the forms.aspx as the IIS properties
specify.

Any ideas?

David Wang [Msft]
1/23/2004 4:01:06 AM
Hmm...

How are you actually configuring your custom error such that it does not
work?

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
I found the following posting,
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=utf-8&selm=Rnw8J81PCHA.1712%40cpmsftngxa07

which loosely explains how to do a joint NTLM/Passport authenticated
site, with a database for roles. I have been able to modify this
slightly to work for my own form authentication (actually using
<authentication="None"> though) Basically I have to manage a cookie
or session object that lets the system know the user is logged in.

I'm trying to follow the example in 5A of that posting. It has an
NTLM authenticated page which errors out to a form for logging in if
the user can't authenticate. Thus, the entire site has no .NET
managed authentication, and all but this one NTLM authenticated page
are anonymous.

Example:
ntlm.aspx - NTLM authenticated, if not, redirect to
forms.aspx
forms.aspx - form, anonymous access
Page3.aspx - once authenticated go here
anyotherpage.aspx - redirect to ntlm.aspx if not authenticated.

The problem is that whenever the ntlm.aspx fails authenticating, it
can't successfully redirect to the forms.aspx as the IIS properties
specify.

Any ideas?

Shawn

David Wang [Msft]
1/23/2004 5:59:51 PM
How are you actually configuring your custom error such that it does not
work?

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
I found the following posting,
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=utf-8&selm=Rnw8J81PCHA.1712%40cpmsftngxa07

which loosely explains how to do a joint NTLM/Passport authenticated
site, with a database for roles. I have been able to modify this
slightly to work for my own form authentication (actually using
<authentication="None"> though) Basically I have to manage a cookie
or session object that lets the system know the user is logged in.

I'm trying to follow the example in 5A of that posting. It has an
NTLM authenticated page which errors out to a form for logging in if
the user can't authenticate. Thus, the entire site has no .NET
managed authentication, and all but this one NTLM authenticated page
are anonymous.

Example:
ntlm.aspx - NTLM authenticated, if not, redirect to
forms.aspx
forms.aspx - form, anonymous access
Page3.aspx - once authenticated go here
anyotherpage.aspx - redirect to ntlm.aspx if not authenticated.

The problem is that whenever the ntlm.aspx fails authenticating, it
can't successfully redirect to the forms.aspx as the IIS properties
specify.

Any ideas?

Shawn

AddThis Social Bookmark Button