Using IIS Manager Users Authentication in your Web Application

  • Article

Today in the IIS.NET Forums a question was asked if it was possible to use the same IIS Manager Users authentication in the context of a Web Application so that you could have say something like WebDAV using the same credentials as you use when using IIS Manager Remote Administration.

The IIS Manager Remote Administration allows you to connect to manage your Web Site using credentials that are not Windows Users, but instead just a combination of User and Password. This is implemented following a Provider model where the default implementation we ship uses our Administration.config file (%windir%\system32\inetsrv\config\administration.config) as the storage for this users. However, you can easily implement a base class to authentication against a database or any other users store if needed. This means you can build your own application and call our API's (ManagementAuthentication).

Even better in the context of a Web Site running in IIS 7.0 you can actually implement this without having to write a single line of code.

Disclaimer: Administration.config out-of-the box only has permissions for administrators to be able to read the file. This means that a Web Application will not be able to access the file, so you need to change the ACL's in the file to provide read permissions for your Application, but you should make sure that you limit the read access to the minimum required such as below.

Here is how you do it:

  1. First make sure that your Web Site is using SSL to use this. (Use IIS Manager and right click your Web Site and Edit Bindings and add an SSL binding).
  2. So that we can restrict permissions further, make your application run in its own Application Pool, this way we can change the ACL's required to only affect your application pool and nothing else. So using IIS Manager go to Application Pools and add a new Application running in Integrated Mode, and give it a name you can easily remember, say WebMgmtAppPool (we will use this in the permissions below) .
  3. Disable Anonymous Authentication in your application. (Use IIS Manager, drill-down to your application, double click the Authentication feature and disable Anonymous Authentication and any other authentication module enabled).
  4. Enable the Web Management Authentication Module in your application, you can add a Web.config file with the following contents on it: <configuration>
      <system.webServer>
        <modules>
          <add name='WebManagementBasicAuthentication' 
    type='Microsoft.Web.Management.Server.WebManagementBasicAuthenticationModule, Microsoft.Web.Management, Version=7.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35' />
    </modules>
      </system.webServer> 
    </configuration> 
  5. Modify the ACL's in the required configuration files:
    1. Give read access to the config directory so we can access the files using the following command line (note that we are only giving permissions to the Application Pool)
      icacls %windir%\system32\inetsrv\config /grant "IIS AppPool\WebMgmtAppPool":(R)
    2. Give read access to the redirection.config:
      icacls %windir%\system32\inetsrv\config\redirection.config /grant "IIS AppPool\WebMgmtAppPool":(R)
    3. Finally give read access to administration.config:
      icacls %windir%\system32\inetsrv\config\administration.config /grant "IIS AppPool\WebMgmtAppPool":(R)
  6. At this point you should be able to navigate to your application using any browser and you should get a prompt for credentials that will be authenticated against the IIS Manager Users.

What is also nice is that you can use URL Authorization to further restrict permissions in your pages for this users, for example, if I didn't want a particular IIS Manager User (say MyIisManagerUser) to access the Web Site I can just configure this in the same web.config:

<configuration>
  <system.webServer>
        <security>
            <authorization>
                <add accessType="Deny" users="MyIisManagerUser" />
</authorization>
        </security>
  </system.webServer>
</configuration>

If you want to learn more about remote administration and how to configure it you can read: https://learn.iis.net/page.aspx/159/configuring-remote-administration-and-feature-delegation-in-iis-7/