Denying users in windows authentication IIS 8.5

Question

I'm pretty new to .NET and I created a simple asp.net core web app using razor. I successfully published it in my IIS 8.5. I enabled windows authentication each time an user wants to access the page in my company network. However I'd like to restrict the access to all the users in the network except to a few users. I tried modifying my web.config file as follows:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <location path="." inheritInChildApplications="false">
    <system.webServer>
    <security>
      <authorization>
                <remove users="*" roles="" verbs="" />
                <add accessType="Deny" users="*" />
                <add accessType="Allow" users="Alice,Bob" />
      </authorization>
          </security>
      <handlers>
        <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
      </handlers>
      <aspNetCore processPath="dotnet" arguments=".\Autentificacion.dll" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" hostingModel="inprocess" />
      
    </system.webServer>
  </location>
</configuration>

After accessing the website the user is asked to put their windows user credentials but any user in the network can access the website not only Alice or Bob. Do I need to change an IIS configuration?

Answer 1

You want to look into authorization Policies.

services.AddAuthorization(options =>
        {
            options.AddPolicy("NewPolicy", policy =>
                policy.RequireAssertion(context =>
                    context.User.IsInRole("Some cool user group")));
        });

Where the users you want to have access are a part of a user group called "Some cool user group".

From there you may protect your routes and controllers with this policy by using the Authorize Attribute:

[Authorize(Policy = "NewPolicy")]

further reading: https://chrissainty.com/securing-your-blazor-apps-configuring-policy-based-authorization-with-blazor/

I would not recommend fiddling with the IIS web.config unless absolutely necessary.