Member Avatar for mindfrost82

I'm using IIS on Windows 2k3 R2.

What I'm wanting to do is create a folder called /accounts/ on the server that requires Integrated Windows Authentication. I can do that, no problem.

Then from there I want subfolders, but I only want it to show the subfolders that user is authorized to view.

For example, say I have a user named test and test2. Then I have a folder setup like this:

/accounts/
/accounts/test/
/accounts/test2/

Now when I go to the /accounts/ folder from a browser it will prompt me to login. If I login with the test user, I only want it to show the test folder and hide all other folders. If I login with the test2 user it would show the test2 folder and hide all other folders.

Is this possible, and if so, how would I do this? I've tried all different kinds of permissions, but everything seems to either hide everything or show everything. If I login at test and click on the test2 folder it won't give me access, which is fine, but I would rather have it not show the entire test2 folder.

Thanks for any help.

  • 1 Contributor
  • 2 Replies
  • 126 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by mindfrost82

Dani AI

Generated

Short answer for : IIS built-in Directory Browsing will show whatever the web server process can enumerate — it does not automatically filter the listing by the currently authenticated user’s NTFS ACLs. To hide other users' folders you must either stop using the built‑in directory listing and redirect users to their own folder, or generate your own listing under the authenticated user context and filter it.

A simple, reliable approach: disable Directory Browsing on /accounts/ and place an index script that reads the authenticated username from the server variables and redirects to that user’s folder. Example (PHP):

<?php
$user = !empty($_SERVER['LOGON_USER']) ? $_SERVER['LOGON_USER']
      : (!empty($_SERVER['REMOTE_USER']) ? $_SERVER['REMOTE_USER']
      : (!empty($_SERVER['AUTH_USER']) ? $_SERVER['AUTH_USER'] : ''));

if ($user !== '') {
    if (($p = strrpos($user, '\\')) !== false) $user = substr($user, $p + 1);
    $user = preg_replace('/[^A-Za-z0-9_.-]/', '', $user);
    header('Location: /accounts/' . rawurlencode($user) . '/');
    exit;
}
?>

If you need a visible index that only lists folders the user can actually open, implement a server-side listing page that runs under the user’s identity and tests access. In ASP.NET that means enabling Windows Authentication and either enabling impersonation in web.config or calling WindowsIdentity.Impersonate; then enumerate directories and hide any that throw UnauthorizedAccessException. Example C# redirect snippet:

string username = User.Identity.Name;
if (username.Contains("\\")) username = username.Substring(username.IndexOf("\\") + 1);
Response.Redirect("/accounts/" + Server.UrlEncode(username) + "/");

Troubleshooting/security notes: confirm which server variable your setup exposes (use phpinfo() or Request.ServerVariables), disable anonymous access so Windows auth is used, sanitize the username to prevent path traversal, and map AD usernames to folder names consistently. On Windows Server 2003 / IIS6 there’s no built‑in option to filter the directory listing per-user, so a small app (redirect or custom listing) is the practical solution.

Member Avatar for mindfrost82

No ideas?

Is there any kind of variable that is passed during the login that I could use as a redirect?

For example, if I setup the Home Directory for the test user to /accounts/test/, is there anyway to pull that directory with PHP (or another scripting language) and set it to redirect to their home directory?

Member Avatar for mindfrost82

A mod can delete this. I just saw the sticky about not posting support questions here. I re-posted this question under the PHP forum.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.