为IIS 8.5上带LDAPS认证的Django应用启用匿名认证的问题

Hey there, let's work through this IIS + Django LDAPS issue you're facing. First, let's recap your setup to make sure I'm on the same page:

• You've got an IIS 8.5 site with a Django app split into two separate folders: DjangoApp (code) and DjangoAppStaticFiles (static assets)
• The Django app uses LDAPS for authentication, and you want these two folders to allow anonymous access to avoid double login prompts
• Other apps under the same site (SomeOtherWindowsAuthenticatedApp, AnotherWindowsAuthenticatedApp) need to keep Windows authentication enabled

From your note that enabling anonymous auth on those two folders caused an issue, I'll cover the most common problems and fixes below:

1. Fix Inheritance Issues (Most Likely Culprit) #

IIS applies authentication settings hierarchically by default. If you just enabled anonymous auth on DjangoApp and DjangoAppStaticFiles without breaking inheritance, those settings might be leaking to other apps. Here's how to fix that:

• Open IIS Manager, navigate to your site
• Right-click DjangoApp → Switch to Content View → Right-click the folder → Open Properties (or use the "Authentication" feature in Features View)
• In the Authentication panel, click Edit Feature Permissions on the right sidebar
• Uncheck Inherit from parent (you'll get a prompt to copy existing settings or remove them; choose "Copy" to keep your anonymous auth setting, then adjust as needed)
• Repeat this exact process for DjangoAppStaticFiles
• Now go back to the other Windows-authenticated apps, verify their Authentication settings still have Anonymous Auth disabled and Windows Auth enabled (they shouldn't inherit the anonymous setting anymore)

2. Ensure Django's LDAPS Authentication Still Works #

When you enable anonymous auth on the Django code folder, you need to make sure Django's own LDAPS middleware isn't bypassed. Here's what to check:

• In your Django settings.py, confirm you have these middleware classes in the correct order (critical for auth flow):

  MIDDLEWARE = [
      'django.middleware.security.SecurityMiddleware',
      'django.contrib.sessions.middleware.SessionMiddleware',
      'django.middleware.common.CommonMiddleware',
      'django.middleware.csrf.CsrfViewMiddleware',
      'django.contrib.auth.middleware.AuthenticationMiddleware',  # Key for LDAPS handling
      'django.contrib.messages.middleware.MessageMiddleware',
      'django.middleware.clickjacking.XFrameOptionsMiddleware',
  ]
  

• Make sure your LDAPS backend is properly configured in AUTHENTICATION_BACKENDS:

  AUTHENTICATION_BACKENDS = [
      'django_auth_ldap.backend.LDAPBackend',
      'django.contrib.auth.backends.ModelBackend',  # Optional fallback
  ]
  

• If you're using wsgi.py with IIS, ensure you're not letting IIS handle auth for Django routes—keep IIS anonymous so Django can manage LDAPS auth itself.

3. Static Files Access Without Breaking Auth #

For DjangoAppStaticFiles, enabling anonymous auth is correct, but double-check these details:

• The folder has proper NTFS permissions: grant the IUSR account read access to the static files (IIS uses this account for anonymous requests)
• In your Django settings.py, confirm STATIC_URL and STATIC_ROOT point correctly to this folder, and you've run python manage.py collectstatic to populate it with assets

4. Troubleshooting Common Post-Issues #

If you're still seeing double login prompts:

• Clear your browser's cache and cookies—old auth sessions can get stuck and cause repeated prompts
• Use IIS's Failed Request Tracing feature to pinpoint exactly where the auth prompt is coming from (is it IIS enforcing auth, or Django's LDAPS flow?)
• Verify your LDAPS configuration is correctly pointing to your domain controller, and that the service account Django uses has permission to query LDAP for user data

内容的提问来源于stack exchange，提问作者OverflowingTheGlass