Limit login attempts to a SharePoint server to a single OU

Question

The setup:
Several SharePoint 2010 Foundation web applications, each on individual servers. Default SharePoint authentication mechanism in use Single Active Directory Domain controls user access. An OU is used to group together accounts that should be able to only access one webapp(server).

Problem: User accounts are valid on the domain so if they try to access another server with that account they will receive an access denied message. This confirms the webapp/site collection are valid. And possibly offers the ability to request access to the site. I can not use forms authentication for these applications.

Other solutions: I've reviewed other postings that were similar to this request but not asking about controlling multiple servers specific to a single OU. The ones I found were about controlling the access denied messages on a single webapp.

Question: Do you have a suggestion on how I could only allow a single OU the ability to get into the web application. If the users is not in the OU for that server they would receive something from IIS such as a 401 auth denied message.

Answer 1

It is possible to set access controls to the web application that limit the access to specific AD Security Groups. If you can create an AD Security Group that matches that OU's membership you could use that for inclusion or exclusion.

This is all configured within the Web Application's settings.

Answer 2

I would probably create an httpmodule to intercept the requests to the site and check if the user is in the OU.

If not redirect to a page of your choice such as 401.