Force authentication for specific IP range on IIS I have a Drupal 6 installation as a corporate Intranet site.  I would like to permit a set of IP ranges the ability to view the site anonymously, and anything that does not match that rule must authenticate (either by form, or by HTTP - either would be fine).

I've looked at httpauth (obsolete) - this could be made to work, but I found it wasn't reliable under IIS.

I looked at securesite (what took the place of httpauth), but was getting issues with the form authentication (didn't look at the http authentication portion in detail).

In both cases, the modules didn't seem to be configurable to configure that behaviour on a per-ip basis, but I expect could be modified to do so.

Anyone know of anything out there that might solve this problem?
Use the Rules module to determine if the user is from a specific IP range, or is authenticated.  If they are not from that IP range or not logged in, redirect to Login page.


Install and enable Rules module.
Create a new Rule that is triggered when Drupal is initializing.
Add a Condition of Data, Text Comparison
Add a Data field of site:current-page:path that matches user, and negate the condition so this Rule requires this Condition to be False.
Add a Condition Or group, set it to Negate, so that if neither condition are positive it will execute an action
Within the Or group, add a condition that executes PHP Code. Enter PHP code that returns True if the IP is in range (learn how to get the visitors IP).
Within the Or group, add another condition of User's role. Configure the condition to return true if the User has the Authenticated User role.
Add an Action of Page redirect, and redirect the user to user, or some other page where they can login.
Save and enable the Rule.