MVC Web Api won't allow Windows Authentication

Question

I have a simple MVC web api 2 IIS hosted application which I want to enable windows authentication (initially not using Owin). I am running this on my development machine and running as local IIS.

So, from what I could find, I need to add the following to the web.config

1: to the following section the authentication mode="Windows"

<system.web>
  <compilation debug="true" targetFramework="4.5.1"/>
  <httpRuntime targetFramework="4.5.1"/>
  <authentication mode="Windows" />
</system.web>

2: Then add the following

<system.webServer>
  <security>
    <authentication>
      <windowsAuthentication enabled="true"/>
    </authentication>
  </security>

When I add the above and run the application (in debug from Dev studio), I get the following error

HTTP Error 500.19 - Internal Server Error

Config Error This configuration section cannot be used at this path. This happens when the section is locked at a parent level. Locking is either by default (overrideModeDefault="Deny"), or set explicitly by a location tag with overrideMode="Deny" or the legacy allowOverride="false".

and then it specifically points to this web config entry

Config Source:

37:     <authentication>
38:       <windowsAuthentication enabled="true"/>
39:     </authentication>

Anyone have any ideas why I would be getting this?

Also, I noticed when I switch to IIS express, that in the project properties, the Windows Authentication is set to disabled, and grayed out so I cannot set it here either.

Thanks in advance for any help!

Answer 1

If you read applicationHost.config, you will see that authentication related sections are locked down and cannot be overridden in web.config,

<section name="windowsAuthentication" overrideModeDefault="Deny" />

Thus, you need to specify that in applicationHost.config, instead of web.config. Both IIS and IIS Express have such restriction.