Web Site Access requires UserID and Password

27 Oct 2006 10:14 AM

baker_tony

I copied over a new Default.htm file to a web server one day, and all
of a sudden whenever anyone went to our web site they were being
prompted to enter userId and password! Directory access was set to
anonymous.

Way I fixed it was to:
1) right click Default.htm and bring up properties
2) Go to security tab
3) Add "Everyone" user
4) set Everyone user to have Read access
5) Hit OK,

Problem solved, I hope this helps someone!

Tony.

27 Oct 2006 10:27 AM

David Wang

While I am glad that your issue is resolved, your resolution is simply
inappropriate and incorrect.

Anonymous access does not mean that you never see an authentication
prompt. It means that IIS always logs in and uses a pre-defined user
account for all non-authenticated access to resources.

Your problem is that your somehow broke ACLs on your web content such
that the IIS Anonymous user no longer has permissions to read those
files - hence when you add "Everyone" permissions, IIS Anonymous user
is included and hence it appears to work. The problem with adding
Everyone is that EVERYONE is able to read, not just the IIS anonymous
user. This may not be what you intended and is overkill for getting
Anonymous authentication to function.

The correct solution is to make sure that the authenticated user
identity has read ACLs on the resources. For anonymous authentication,
the authenticated user identity is the IIS Anonymous user you
configured.

Read the following blog entries for the explanation:
http://blogs.msdn.com/david.wang/archive/2005/05/27/Access_Denied_to_Administrators_or_Anonymous_User.aspx

http://blogs.msdn.com/david.wang/archive/2005/06/29/IIS_User_Identity_to_Run_Code_Part_2.aspx

http://blogs.msdn.com/david.wang/archive/2005/10/14/HOWTO_IIS_6_Request_Processing_Basics_Part_1.aspx

//David
http://w3-4u.blogspot.com
//

baker_t***@hotmail.com wrote:
Show quoteHide quote

> I copied over a new Default.htm file to a web server one day, and all
> of a sudden whenever anyone went to our web site they were being
> prompted to enter userId and password! Directory access was set to
> anonymous.
>
> Way I fixed it was to:
> 1) right click Default.htm and bring up properties
> 2) Go to security tab
> 3) Add "Everyone" user
> 4) set Everyone user to have Read access
> 5) Hit OK,
>
> Problem solved, I hope this helps someone!
>
> Tony.

Web Site Access requires UserID and Password - Resolved