Re: Form Authentication (redirect to https)

On Jul 1, 10:30 pm, dgator <dga...@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
I do the redirect through the form authentication section of the web.config
file.

Here is my current entry in web.config

<authentication mode="Forms">
      <forms loginUrl="wtLogon.aspx" name="sqlAuthCookie" timeout="60"
path="/">
      </forms>
    </authentication>

This works if the user types inhttps://www.mysite.com.  If the user type
http>//www.mysite.com, they are redirected to the login page, but still in
http.

If I change the entry in the web.config to the following

<authentication mode="Forms">
      <forms loginUrl="https://www.mysite.com/wtLogon.aspx";
name="sqlAuthCookie" timeout="60" path="/">
      </forms>
    </authentication>

I get the windows login prompt.

Very strange.



"Alexey Smirnov" wrote:
On Jul 1, 1:01 pm, dgator <dga...@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
If i typehttps://www.mysite.comitworks fine as long as the "logonURL" in
the forms authentication section of the web.config just points to the logon
page like "logon.aspx".  

As soon as I change the logonURL to "https://www.mysite.com/logon.aspx";, the
windows logon prompt is presented to the user.

The directory permissions for the IUSR seem to be fine.

Any other thoughts?

Thanks

Daivd

"Alexey Smirnov" wrote:
On Jul 1, 1:16 am, dgator <dga...@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
We are using forms authentication for security within our web app.  Within
the web.config file, we have the logonURL set to "https://www.mysite.com"; so
that if the user gets to the login page via http, they will be forced to
https version.

We do this same redirect on other websites without any problems, but for
some reason on this one website, when we redirect to https, a windows login
prompt is presented to the user which is NOT what we want.  I have looked
throughout the web.config file and the iis setup and see no differences in
the site that works with the redirect and one that doesn't.  

Any ideas?

Thanks in advance.

I think it does mean that the IUSR_<server> account has no access to
the root directory of the site. Check directory permissions to see if
the this account is allowed access to the files. Check if Anonymous
authentication is enabled in IIS.- Hide quoted text -

- Show quoted text -

David, when you do this on other websites, do you use a custom 403
redirect at IIS from http to https?- Hide quoted text -

- Show quoted text -

I think the trick here is that you have to add custom 403 (403;4 if I
am not wrong) in IIS where you can redirect from http://....login.aspx
to https://....login.aspx using simple
Response.Redirect("https://....login.aspx";);
.

Relevant Pages

  • Re: Remote Web Workplace is showing up instead of my OWA
    ... For http to https: ... Just go to web site properties and choose to redirect to a directory below ... Nue ... >>> of diplaying a login for Outlook web access. ...
    (microsoft.public.exchange.admin)
  • Elementary security questions
    ... easy to ensure that the login process was handled entirely over SSL, ... converting a request for the login page made via http into a request ... In my JSP ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: Encrypted or Not Encrypted
    ... Indeed this is a manual redirect initiated by the user instead of a HTTP ... IMHO you need to make sure that you POST credentials via HTTPs. ... A possible test to make sure you establish a secure SSL connection before ... By analyzing the HTTP requests and responses you can also look at the HTTP ...
    (Security-Basics)
  • Re: Default.aspx - newbie Q`
    ... check and redirect to the ReturnURL or Selected.aspx depending on the case. ... > and replace it with something that takes then straight to the login page. ... >> Curt Christianson ... >>> authentication ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Default.aspx - newbie Q`
    ... check and redirect to the ReturnURL or Selected.aspx depending on the case. ... > and replace it with something that takes then straight to the login page. ... >> Curt Christianson ... >>> authentication ...
    (microsoft.public.dotnet.framework.aspnet)
Loading