asp.net-mvc 401 Unauthorized：由于凭据无效，访问被拒绝

401 Unauthorized: Access is denied due to invalid credentials

提问by java.manish.2015

I am using IIS Express to deploy MVC4 application. This website runs perfectly on same computer. But in Lan it gives me error 401.

我正在使用 IIS Express 来部署 MVC4 应用程序。该网站在同一台计算机上完美运行。但是在 Lan 中，它给了我错误 401。

<authentication mode="Forms">
    <forms loginUrl="~/" slidingExpiration="true" timeout="20">
    </forms>
</authentication>

In home controller

在家庭控制器中

[HttpPost]
[AllowAnonymous]        
public ActionResult Index(LoginModel model, string returnUrl)
{
}

I am starting IIS server from command prompt in Administrator mode. IIS responds to the request with error 401.

我在管理员模式下从命令提示符启动 IIS 服务器。IIS 以错误响应请求401。

Any clue?

有什么线索吗？

回答by ctc

I realize this is an older post but I had the same error on IIS 8.5. Hopefully this can help another experiencing the same issue (I didn't see my issue outlined in other questions with a similar title).

我意识到这是一篇较旧的帖子，但我在 IIS 8.5 上遇到了同样的错误。希望这可以帮助另一个遇到相同问题的人（我没有在其他类似标题的问题中看到我的问题）。

Everything seemed set up correctly with the Application Pool Identity, but I continued to receive the error. After much digging, there is a setting for the anonymous user to use the credentials of the application pool identity or a specific user. For whatever reason, mine was defaulted to a specific user. Altering the setting to the App Pool Identity fixed the issue for me.

应用程序池标识似乎设置正确，但我继续收到错误消息。经过大量挖掘，匿名用户可以设置使用应用程序池身份或特定用户的凭据。无论出于何种原因，我的默认为特定用户。将设置更改为 App Pool Identity 为我解决了这个问题。

1. IIS Manager → Sites → Website
2. Double click "Authentication"
3. Select Anonymous Authentication
4. From the Actions panel, select Edit
5. Select Application pool Identity and click ok

1. IIS 管理器 → 站点 → 网站
2. 双击“身份验证”
3. 选择匿名身份验证
4. 从“动作”面板中，选择“编辑”
5. 选择应用程序池标识并单击确定

Hopefully this saves someone else some time!

希望这可以为其他人节省一些时间！

回答by Suraj Shrestha

If you're using IIS 7 do something like this:

如果您使用的是 IIS 7，请执行以下操作：

1. Select your site.
2. Click on error pages.
3. Edit feature settings.
4. Select detailed errors.

1. 选择您的网站。
2. 单击错误页面。
3. 编辑功能设置。
4. 选择详细错误。

Enjoy.

享受。

回答by Steve

In case anyone is still looking for this, this solved the problem for us:

如果有人仍在寻找这个，这为我们解决了问题：

To whoever this may help, this saved my life...

对于这可能有帮助的人，这救了我的命......

IIS 7 was difficult for figuring out why i was getting the 401 - Unauthorized: Access is denied due to invalid credentials... until i did this...

IIS 7 很难弄清楚为什么我会得到 401 - Unauthorized: Access is denied due to invalid credentials... 直到我这样做...

1. Open IIS and select the website that is causing the 401
2. Open the "Authentication" property under the "IIS" header
3. Click the "Windows Authentication" item and click "Providers"
4. For me the issue was that Negotiate was above NTLM. I assume that there was some kind of handshake going on behind the scenes, but i was never really authenticated. I moved the NTLM to the top most spot, and BAM that fixed it.

1. 打开 IIS 并选择导致 401 的网站
2. 打开“IIS”标题下的“身份验证”属性
3. 单击“Windows 身份验证”项，然后单击“提供程序”
4. 对我来说，问题是谈判高于 NTLM。我认为在幕后进行了某种握手，但我从未真正经过身份验证。我将 NTLM 移到最上面的位置，然后 BAM 修复了它。

Here is the link where this was found.

这是找到此内容的链接。

回答by testCoder

Make sure that you enabled anonymous authentication on iis like this:

确保您在 iis 上启用了匿名身份验证，如下所示：

回答by poorraj

I realize its an old question, but this came up in my searches. Had a similar issue for an MVC application recently built, deployed for the first time, and Authentication mechanism wasn't completely hashed out.

我意识到这是一个老问题，但这出现在我的搜索中。最近构建、第一次部署的 MVC 应用程序也有类似的问题，并且身份验证机制没有完全解决。

It wasn't an IIS setting in my case, it was a Controller that was not [AllowAnonymous]decorated. I was using a Render.Action/Html.Action in a Layout.cshtml and the User was unauthenticated. So the Layout tried to load an Authenticated Action in an UnAuthenticated context.

在我的情况下，它不是 IIS 设置，而是一个没有[AllowAnonymous]装饰的控制器。我在 Layout.cshtml 中使用了 Render.Action/Html.Action 并且用户未经身份验证。所以布局试图在 UnAuthenticated 上下文中加载一个 Authenticated Action。

Once I updated the action to AllowAnonymous, the problem went away, and this is what led me to it.

一旦我将操作更新为 AllowAnonymous，问题就消失了，这就是导致我解决它的原因。

Hope this helps someone.

希望这可以帮助某人。

回答by Vijay Vepakomma

I had a similar issue today. For some reason, my GETrequest was fine, but PUTrequest was failing for my WCF WebHttp Service

我今天遇到了类似的问题。出于某种原因，我的GET请求没问题，但我的WCF WebHttp 服务的PUT请求失败了

Adding the following to the Web.config solved the issue

将以下内容添加到 Web.config 解决了问题

 <system.web>
  <authentication mode="Forms" />
 </system.web>

回答by Chris Gong

I faced this error when I created an empty project with the MVC folders and then deployed the application to the server. My issue was that I didn't define the authentication in Web.config, so all I had to do was add this line to a system.webtag.

当我使用 MVC 文件夹创建一个空项目，然后将应用程序部署到服务器时，我遇到了这个错误。我的问题是我没有在 中定义身份验证Web.config，所以我所要做的就是将此行添加到system.web标签中。

<system.web>
    <authentication mode="None"/>
</system.web>

回答by Jishnu

I faced similar issue.

我遇到了类似的问题。

The folder was shared and Authenticated Users permission was provided, which solved my issue.

该文件夹已共享并提供了经过身份验证的用户权限，这解决了我的问题。

回答by Saftpresse99

i faced the same issue under IIS 8.5. A working solution for me was changing the IIS to display detailled errors. See answer from sna2stha. But i think it is not a good idea to forward detailed error messages to browsers in production enviroments. I added/changed the existingResponse attribute in the httpErrors-Section, so the IIS not handled any extisting Asp.net Response:

我在 IIS 8.5 下遇到了同样的问题。对我来说一个可行的解决方案是更改 IIS 以显示详细的错误。请参阅 sna2stha 的答案。但我认为在生产环境中将详细的错误消息转发给浏览器并不是一个好主意。我在 httpErrors-Section 中添加/更改了 existingResponse 属性，因此 IIS 没有处理任何现有的 Asp.net 响应：

<system.webServer>
   <httpErrors existingResponse="PassThrough" />
</system.webServer>

This works for me.

这对我有用。

回答by Rahul Nikate

In my case,
My application is developed in MVCand my home controller class was decorated with [Authorize]which was causing this issue.
So I've removed it because my application don't require any authentication.

就我而言，
我的应用程序是在其中开发的，MVC并且我的家庭控制器类被装饰，[Authorize]这导致了这个问题。
所以我删除了它，因为我的应用程序不需要任何身份验证。