title: Why am I getting a 401.2/Access is denied error deploying my MVC 3 app under IIS 7.5?
body: <p>I'm attempting to deploy an ASP.NET MVC 3 application to a Windows 2008 R2 box. I ran the Web Platform Installer to get the MVC 3 bits and basic IIS settings installed. I created a new folder C:\Website then created a new website and pointed it to this folder. </p>
  
  <p>I see that there is a new app pool indentity, "ApplicationPoolIdentity" which is different from IIS 6 (and is a "special" user account that isn't really available from the security tab on the folder). I manually assigned permission to the C:\Website folder by typing in the account "IIS AppPool\DefaultAppPool" and giving it Read &amp; Execute/List folder contents/Read access (specifically: Traver folder / excute file, List folder / read data, Read attributes, Read extended attributes, Read permissions).</p>
  
  <p>The application pool for this website is configured for v4 of the .NET framework, Integrated pipeline.</p>
  
  <p>In IIS Authentication "Anonymous Authentication" is enabled. </p>
  
  <p>My website has the authentication mode="Windows" in the web.config file. This is the first time I've actually ever used Windows authentication. If it matters, the web server is part of a domain.</p>
  
  <p>When I attempt to access the site I get a Access is denied error, 401.2. I thought it may be related to the Windows authentication setting so I modified the web.config and set the authentication mode to None. I get the same error.</p>
  
  <p>If I go into the website, IIS/Authentication and enable Windows Authentication it prompts me to enter a username/password. If I enter my credentials it works. However, I'm worried that it's only working because it's actually impersonating me on the server (and I have access to everything). I don't really need/want impersonation on the website - I am only using Windows authentication so that we don't have to maintain two sets of logins. The website only checks the roles the user is a member to selectively show/hide content. The default page on the website doesn't have any [Authorize] attributes set on the controller.  is configured in the web.config file.</p>
  
  <p>Secondary question - why would I be prompted for my username/password at all? Wouldn't the challenge/response happen automatically and only prompt if the authentication failed?</p>
  
  <p>Obviously there is some interaction here that I don't understand but I don't know what. I don't see any useful errors in the Event log.</p>
  
  <p>I have searched for the error and attempted some of the fixes already, for example, I attempted to reset the ASP.NET configuration from the command line using: aspnet_regiis -i without any luck.</p>
  
  <p><strong>Resolved</strong></p>
  
  <p>I was able to get this working. Under the website configuration there is an ".NET Authorization" option. This was configured to deny all anonymous users. I removed that rule, then added a rule to allow all anonymous users. Now I could hit the site without logging in. Then I went into IIS Authentication and enabled Windows Authentication and disabled Anonymous Authentication.</p>
  
  <p>Internet Explorer passes the credentials without prompting. Firefox prompts for credentials. There is a configuration setting to configure this:</p>
  
  <ul>
  <li>Open Firefox</li>
  <li>Go to: about:config (and agree to continue)</li>
  <li>Filter for: network.automatic</li>
  <li>Double-click on the network.automatic-ntml-auth.trusted-uris</li>
  <li>Add your site (multiple sites can be comma-delimited). Include the http:// portion.</li>
  </ul>
  
  <p>The machine I'm testing on doesn't have Chrome, but that seems to work OK on my dev. machine.</p>