4

We have SharePoint 2013 public faced web site.

IIS site settings:

  • Anonymous authentication - Enabled
  • Windows authentication - Enabled

Anonymous and authenticated users have ability to visit site. But if anonymous users try to visit layouts pages, for example - https://xxx/_layouts/15/settings.aspx?Source=xxx authentication window appears.

How to prevent authentication prompt and show standard 401 error?

0
2

You can go to site settings->Site collection features->deactivate "Limited-access user permission lockdown mode" feature.

Of course, for other pages, the users need permission to access. If the user wants to access the relevant page, I suggest you give relevant permission to a user account and login with this account.

3
  • Unfortunately it didn't help. I've disabled this feature but situation has not changed. When anonymous user adds "/_layouts/15/Settings.aspx" - authentication window appears – Raf Jun 25 '19 at 7:47
  • Anonymous can only access the content in the SharePoint site, they cannot access the site settings page by default. This page inherits the master page which use LayoutsPageBase base class that it would trigger SharePoint to prompt anonymous users to log on. Reference:blogs.msdn.microsoft.com/zwsong/2010/04/29/… – Hellofiona_MSFT Jun 25 '19 at 8:30
  • But how to prevent prompting anonymous users to log on? I need it due to security reasons. I need to prevent blocking AD accouns in case of this kind of cyber attack. – Raf Jun 25 '19 at 8:59
1

If you have set up Deny All access at the web app level, Authenticated users will be prompted to validate if they should be denied (brilliant).

SharePoint: Anonymous users are prompted for credentials on an anonymous site.

1
  • If i will set Deny All policy, anonymous users will not be able to visit site. – Raf Jul 1 '19 at 4:26
0

I haven't tried this, because I have a 2010 environment, but it looks like it might work. In site permissions under Anonymous Access, select Lists and Libraries. This should block access to all assets unless you grant them specifically. Grant Anonymous read access to your Site Pages, Site Assets, etc. that are needed to view the site. Hopefully this will block/hide access to the layouts content. Source

Otherwise, YOU will not be able to edit the site. If you block the ability to be prompted for access to anonymous users, you as an anonymous user when you first visit will not be able to find a login prompt to authenticate with.

1
  • If I select Lists and Libraries - authentication prompt. It doesn't help. – Raf Jul 1 '19 at 5:42
0

Do you have the pulishing features turned on? Apparently they activate a hidden feature called ViewFormPagesLockdown. If not, use powershell to activate this feature. Try this.

1
  • This feature is already activated. And I want to mansion that _layouts pages are not listview pages. – Raf Jul 1 '19 at 4:23
0

You can display a custom, static 401 page like For access denied error, you can customize it with SharePoint PowerShell commands:

$webApp = Get-SPWebApplication http://sharepoint2013
$webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::AccessDenied,"_layouts/15/Error/AccessDenied.html")
$webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::Login,"_layouts/15/Error/AccessDenied.html")
$webApp.Update() 

Note:

  • The folder “Error” and file "Error/AccessDenied.html" has to be under "_layouts/15" (i.e. C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\template\layouts) on all servers in the farm.

  • To revert back to default configuration, use:

    $webApp = Get-SPWebApplication http://sharepoint2013; $webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::AccessDenied,$null); $webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::Login,$null); $webApp.Update()

1
  • I'be copied _layouts/15/login.aspx. Then edited login.aspx(fields login/pass were removed) but when i try to visit layouts pages as anonymous there are nothing changes. Login prompted. So it doesn't work. – Raf Jul 1 '19 at 4:52
0

Were you able to find a solution? I have tried disabling the windows authentication for the default and internet zones and the prompt stopped appearing at these urls but then the search did not crawl and gave Access denied error. I cannot use the Intranet zone url for search content source as when crawling a not default zone the search results urls for the rest of the zones are like the content source url. I do not want to change the default zone as site is mainly used by anonymous users and I want this zone to be default.

I've tried request blocking rules in the rewrite module of IIS like /_layouts/.aspx* and this hide the login prompt and showed 404 instead but then some of the search webparts were not retrieving data as some of their requests were also blocked...

I'm still searching for a solution but if you do not use search or search webparts for your site or you do not mind making your editors site a default zone you might consider disallowing the windows authentication either in the extended site settings or in IIS

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.