401 Unauthorized: Access is denied due to invalid credentials

Question

I am using IIS Express to deploy MVC4 application. This website runs perfectly on same computer. But in Lan it gives me error 401.

<authentication mode="Forms">
    <forms loginUrl="~/" slidingExpiration="true" timeout="20">
    </forms>
</authentication>

In home controller

[HttpPost]
[AllowAnonymous]        
public ActionResult Index(LoginModel model, string returnUrl)
{
}

I am starting IIS server from command prompt in Administrator mode. IIS responds to the request with error 401.

Any clue?

score 280 · Answer 1 · edited May 28 '16 at 19:47

280

I realize this is an older post but I had the same error on IIS 8.5. Hopefully this can help another experiencing the same issue (I didn't see my issue outlined in other questions with a similar title).

Everything seemed set up correctly with the Application Pool Identity, but I continued to receive the error. After much digging, there is a setting for the anonymous user to use the credentials of the application pool identity or a specific user. For whatever reason, mine was defaulted to a specific user. Altering the setting to the App Pool Identity fixed the issue for me.

IIS Manager → Sites → Website
Double click "Authentication"
Select Anonymous Authentication
From the Actions panel, select Edit
Select Application pool Identity and click ok

Hopefully this saves someone else some time!

edited May 28 '16 at 19:47

Uwe Keim

39,551
56
175
291

answered Mar 03 '15 at 16:31

ctc

3,373
1
18
14

7

Also allow in ".net authorization rules" – Per G Sep 25 '15 at 13:00
5

Just in case this isn't it for you, what screwed me up was that I had deleted iisstart, and I created a default.htm but really the default.htm was default.htm.txt because Microsoft Loves to Lie About Things and that server had file-extensions hidden. Thanks microsoft for being so lame. – Warren P Jan 06 '16 at 19:10
3

what happened when windows Authentication is enabled – sss Nov 10 '16 at 09:17
1

Also, if requesting a resource that's not in the root of the site, check to see if there is another web.config anywhere in the directory path to the resource. If there is, it may have an authorization element that denies anonymous access. – Antony Oct 10 '18 at 16:37
IUSR was set and working for me, and still works on a different server, but I wonder what would cause it to stop working? Changing to Anonymous Auth fixed it though. I did recently modify file share permissions so it could be related to that. – mindmischief Aug 31 '20 at 16:27
BOOM! Thanks for this. I had to add the extra step of restarting IIS but after that I realised you are a hero. This had somehow slipped into the mix when I shared a virtual dir (for backups) after it had be working for years previously. – Cueball 6118 Mar 21 '21 at 02:27
Set up the permissions for the app pool user and then always forget about anonymous auth setting. Thanks! :) – CResults Jun 09 '21 at 18:03
Using this method I went from a 401 error to a 403 error (Forbidden: Access is denied) – Burndog Nov 01 '21 at 22:34
@Burndog you may have to check folder permissions also. I've seen something similar in the past when the service account didn't have permissions to read files. – ctc Nov 03 '21 at 21:39

score 33 · Answer 2 · edited Oct 14 '20 at 12:55

33

If you're using IIS 7 do something like this:

Select your site.
Click on error pages.
Edit feature settings.
Select detailed errors.

edited Oct 14 '20 at 12:55

Leandro Bardelli

10,561
15
79
116

answered Dec 05 '12 at 06:10

Suraj Shrestha

1,790
1
25
51

I had only forms auth in place with anonymos access of the login page. While everything worked fine on the machine itsself I was getting 401 from a remote machine. "Select detailte error" fixed the problem. I don't understand how that made the auth problem go away, but it worked. – Karl Nov 29 '17 at 10:59
I was having this issue deploying a MVC app. In Dev environment, special pages for errors (404, 401, etc.) were working fine. But in Production environment it didn't... until I changed what Uwe and Suraj said. Thanks. – Rolo Sep 28 '18 at 16:41
I gave you a +1 since this fixed my issue, but I wish I knew why this fixed the issue. In any case, thanks. – Doug F Feb 11 '20 at 16:45

score 13 · Answer 3 · answered Nov 08 '12 at 07:19

13

Make sure that you enabled anonymous authentication on iis like this:

enter image description here

answered Nov 08 '12 at 07:19

testCoder

7,155
13
56
75

1

Yes Anonymous authentication is enabled. – java.manish.2015 Nov 08 '12 at 15:38

score 13 · Answer 4 · edited May 28 '16 at 19:46

In case anyone is still looking for this, this solved the problem for us:

To whoever this may help, this saved my life...

IIS 7 was difficult for figuring out why i was getting the 401 - Unauthorized: Access is denied due to invalid credentials... until i did this...

Open IIS and select the website that is causing the 401
Open the "Authentication" property under the "IIS" header
Click the "Windows Authentication" item and click "Providers"
For me the issue was that Negotiate was above NTLM. I assume that there was some kind of handshake going on behind the scenes, but i was never really authenticated. I moved the NTLM to the top most spot, and BAM that fixed it.

Here is the link where this was found.

score 13 · Answer 5 · answered Dec 16 '20 at 18:49

13

I had this issue on IIS 10. This is how I fixed it.

Open IIS
Select The Site
Open Authentication
Edit Anonymous Authentication
Select Application Pool Identity

answered Dec 16 '20 at 18:49

greenlight247

131
1
2

1

WOW! This just ended my week long headache. I just moved a web app from Windows auth to ADFS AND upgraded the server to 2019 and was about to give up and go back to the old 2012 server. Thank you!!!!!!!! – Jamie Dec 16 '21 at 20:30
What does this do? And why is it defaulted this way? – tnk479 Dec 13 '22 at 15:26

score 9 · Answer 6 · edited Apr 13 '17 at 12:13

I realize its an old question, but this came up in my searches. Had a similar issue for an MVC application recently built, deployed for the first time, and Authentication mechanism wasn't completely hashed out.

It wasn't an IIS setting in my case, it was a Controller that was not [AllowAnonymous] decorated. I was using a Render.Action/Html.Action in a Layout.cshtml and the User was unauthenticated. So the Layout tried to load an Authenticated Action in an UnAuthenticated context.

Once I updated the action to AllowAnonymous, the problem went away, and this is what led me to it.

Hope this helps someone.

score 4 · Answer 7 · answered Jul 31 '17 at 14:32

I faced this error when I created an empty project with the MVC folders and then deployed the application to the server. My issue was that I didn't define the authentication in Web.config, so all I had to do was add this line to a system.web tag.

<system.web>
    <authentication mode="None"/>
</system.web>

score 3 · Answer 8 · answered Aug 31 '15 at 09:31

3

I faced similar issue.

The folder was shared and Authenticated Users permission was provided, which solved my issue.

answered Aug 31 '15 at 09:31

Jishnu

31
1

score 3 · Answer 9 · edited Jan 21 '20 at 12:00

i faced the same issue under IIS 8.5. A working solution for me was changing the IIS to display detailled errors. See answer from sna2stha. But i think it is not a good idea to forward detailed error messages to browsers in production enviroments. I added/changed the existingResponse attribute in the httpErrors-Section, so the IIS not handled any extisting Asp.net Response:

<system.webServer>
   <httpErrors existingResponse="PassThrough" />
</system.webServer>

This works for me.

score 3 · Answer 10 · answered Jun 13 '17 at 20:21

3

I had a similar issue today. For some reason, my GET request was fine, but PUT request was failing for my WCF WebHttp Service

Adding the following to the Web.config solved the issue

 <system.web>
  <authentication mode="Forms" />
 </system.web>

answered Jun 13 '17 at 20:21

Vijay Vepakomma

733
6
9

score 3 · Answer 11 · edited Jan 12 '22 at 15:05

3

Right click on the main directory where the project files are located.

Properties-> Security-> Edit-> Add-> type IIS_IUSRS and click on "Check Names" button.

The result will look like ComputerUsername\IIS_IUSRS

For example: DESKTOP-M0R6PVF\IIS_IUSRS

and then click on "Ok" button.

edited Jan 12 '22 at 15:05

Amirhossein Rahmati

381
1
6
16

answered Jan 12 '22 at 14:09

BurhanY

81
6

score 2 · Answer 12 · answered Jun 27 '20 at 20:13

2

In my case, what made it work was changing the Anonymous User identity from Specific user (IUSR) to Application Pool Identity. Weird enought because other sites are using the specific user IUSR and work fine.

answered Jun 27 '20 at 20:13

Guy

1,232
10
21

score 2 · Answer 13 · answered Apr 02 '21 at 13:55

As so many answers have demonstrated, the error might be caused by a variety of reasons. In my case it was connected to authorization rules: they were added much later after the application was deployed. This feature of IIS is turned on as a Windows component (World Wide Web Services->Security->URL Authorization).

This particular section inside web.config was to blame:

<system.webServer>
  <security>
    <authorization>
      <remove users="*" roles="" verbs="" />
      <add accessType="Deny" users="?" />
      <add accessType="Deny" users="user1,user2" />
      <add accessType="Allow" users="*" />
    </authorization>
  </security>
</system.webServer>

Thus the record for users="?" blocked access to a path with anonymous authentication too since it inherited the rules by default. However, in IIS you can go to a particular folder/file that should be accessed anonymously and choose Authorization Rules:

Here it's possible to overwrite the rules locally by removing the old one and optionally adding the allowed rule instead to make it more explicit:

SharpC · Answer 14 · 2020-10-14T17:00:22.527

1

I had a permissions issue to a website and just couldn't get Windows authentication to work. It was a folder permissions rather than ASP.NET configuration issue in the end and once the Everyone user was granted permissions it started working.

edited Oct 14 '20 at 17:00

answered Jan 14 '20 at 10:10

SharpC

6,974
4
45
40

score 1 · Answer 15 · answered Feb 28 '20 at 00:11

1

I had a slightly different problem. The credential problem was for the underlying user running the application, not the user trying to login. One way to test this is to go to IIS Management -> Sites -> Your Site -> Basic Settings -> Test Settings.

answered Feb 28 '20 at 00:11

Federico

1,636
2
22
24

score 1 · Answer 16 · answered Nov 15 '21 at 18:07

1

You can press F4 on the web project to get the "Project Properties" window.

Then make sure Anonymous Authentication is Enabled in the "Development Server" section:

answered Nov 15 '21 at 18:07

d.popov

4,175
1
36
47

score 0 · Answer 17 · answered Jan 31 '18 at 14:02

0

In my case,
My application is developed in MVC and my home controller class was decorated with [Authorize] which was causing this issue.
So I've removed it because my application don't require any authentication.

answered Jan 31 '18 at 14:02

Rahul Nikate

6,192
5
42
54

401 Unauthorized: Access is denied due to invalid credentials

17 Answers17

Linked