IIS 7 和 Windows 身份验证
我们在 Windows 2008 Server 上运行 IIS 7，该服务器托管许多 Intranet 网站。我们希望对网站使用 Windows 身份验证，其 url 将为 http://pay
因此，我添加了 C:\InetPub\ pay 文件夹并将其绑定到 IIS7。
禁用匿名身份验证模式。 启用 Windows 身份验证模式。
当我从另一台计算机访问网站 http://pay 时，我收到消息：
未经授权您无权查看此目录或页面 使用您提供的凭据。
因此，我转到 Windows 资源管理器并添加 Local\IUSR 帐户并授予对该文件夹的访问权限。但我仍然遇到同样的错误。
最后，我添加了 Everyone 帐户并授予对该文件夹的访问权限。这次，它成功了，Windows 身份验证也运行良好。
我担心的是，它是否开放了Everyone对\MyServer\C$\Inetpub\pay文件夹的读取权限？它包含包含服务器和用户凭据的 web.config，这将是一个重大的安全漏洞。
如何在不授予 Everyone 帐户访问权限的情况下使用 Windows 身份验证？
提前致谢。
We have IIS 7 running on the Windows 2008 Server which hosts many intranet websites. We want to use windows authentication for the website and its url will be http://pay
So, I add the C:\InetPub\pay folder and bind it to the IIS7.
Disable the Anonymous Authentication mode.
Enable the Windows Authentication mode.
When I access the website http://pay from the other computer, I got the message that
Unauthorized You do not have permission to view this directory or page
using the credentials that you supplied.
So, I go to the Windows Explorer and Add the Local\IUSR account and give access to the folder. But I still got the same error.
Finally, I added Everyone account and give access to the folder. This time, it works and windows authentication is also working well.
What I am afraid is that, does it open the read access to Everyone to the \MyServer\C$\Inetpub\pay folder? It contains the web.config which contains server and users credential and it would be the big security breach.
How can I achieve to use Windows Authentication without giving access to Everyone account?
Thanks in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我相信您正在寻找的是 IIS_IUSRS 组，在使用 Windows 身份验证时，您应该向该组授予对网站文件夹的读取访问权限。您尝试的 IUSR 帐户将用于匿名身份验证场景。
有关 IIS7 中这些组的更多信息，请参见此处：
了解内置IIS 7 中的用户和组帐户
I believe what you you're looking for is the IIS_IUSRS group which you should give read access to your website folders when using Windows Authentication. The IUSR account you tried would be used in an Anonymous Authentication scenario.
More info on these groups in IIS7 here:
Understanding Built-In User and Group Accounts in IIS 7