4

We have SharePoint 2013 public faced web site.

IIS site settings:

  • Anonymous authentication - Enabled
  • Windows authentication - Enabled

Anonymous and authenticated users have ability to visit site. But if anonymous users try to visit layouts pages, for example - https://xxx/_layouts/15/settings.aspx?Source=xxx authentication window appears.

How to prevent authentication prompt and show standard 401 error?

2

You can go to site settings->Site collection features->deactivate "Limited-access user permission lockdown mode" feature.

Of course, for other pages, the users need permission to access. If the user wants to access the relevant page, I suggest you give relevant permission to a user account and login with this account.

  • Unfortunately it didn't help. I've disabled this feature but situation has not changed. When anonymous user adds "/_layouts/15/Settings.aspx" - authentication window appears – Raf Jun 25 at 7:47
  • Anonymous can only access the content in the SharePoint site, they cannot access the site settings page by default. This page inherits the master page which use LayoutsPageBase base class that it would trigger SharePoint to prompt anonymous users to log on. Reference:blogs.msdn.microsoft.com/zwsong/2010/04/29/… – Hellofiona_MSFT Jun 25 at 8:30
  • But how to prevent prompting anonymous users to log on? I need it due to security reasons. I need to prevent blocking AD accouns in case of this kind of cyber attack. – Raf Jun 25 at 8:59
1

If you have set up Deny All access at the web app level, Authenticated users will be prompted to validate if they should be denied (brilliant).

SharePoint: Anonymous users are prompted for credentials on an anonymous site.

  • If i will set Deny All policy, anonymous users will not be able to visit site. – Raf Jul 1 at 4:26
0

I haven't tried this, because I have a 2010 environment, but it looks like it might work. In site permissions under Anonymous Access, select Lists and Libraries. This should block access to all assets unless you grant them specifically. Grant Anonymous read access to your Site Pages, Site Assets, etc. that are needed to view the site. Hopefully this will block/hide access to the layouts content. Source

Otherwise, YOU will not be able to edit the site. If you block the ability to be prompted for access to anonymous users, you as an anonymous user when you first visit will not be able to find a login prompt to authenticate with.

  • If I select Lists and Libraries - authentication prompt. It doesn't help. – Raf Jul 1 at 5:42
0

Do you have the pulishing features turned on? Apparently they activate a hidden feature called ViewFormPagesLockdown. If not, use powershell to activate this feature. Try this.

  • This feature is already activated. And I want to mansion that _layouts pages are not listview pages. – Raf Jul 1 at 4:23
0

You can display a custom, static 401 page like For access denied error, you can customize it with SharePoint PowerShell commands:

$webApp = Get-SPWebApplication http://sharepoint2013
$webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::AccessDenied,"_layouts/15/Error/AccessDenied.html")
$webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::Login,"_layouts/15/Error/AccessDenied.html")
$webApp.Update() 

Note:

  • The folder “Error” and file "Error/AccessDenied.html" has to be under "_layouts/15" (i.e. C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\template\layouts) on all servers in the farm.

  • To revert back to default configuration, use:

    $webApp = Get-SPWebApplication http://sharepoint2013; $webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::AccessDenied,$null); $webApp.UpdateMappedPage([Microsoft.SharePoint.Administration.SPWebApplication+SPCustomPage]::Login,$null); $webApp.Update()

  • I'be copied _layouts/15/login.aspx. Then edited login.aspx(fields login/pass were removed) but when i try to visit layouts pages as anonymous there are nothing changes. Login prompted. So it doesn't work. – Raf Jul 1 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.