Absolutely. What you linked, was back when Umbraco was used with Webforms, but since then it has switched to MVC, you can still use Webforms but would not recommend it.

I could type in all the code you need. BUT for your sake i think it's better if you go to the Umbraco backend, go to the settings section and then go to Partial View and create a new partial view, it will prompt you to enter a name and and if you want a to choose template, here you can choose the Login template, which will supply you with all the code you need. then you can call your partial view on whatever page you want like this.

@Html.Partial("PartialViewNameHere")

Hope this gives you an idea and that it helps

I think you'd be best doing this at the IIS level - either with an IP restriction or basic auth.

Yes, Steve, it would be better at IIS level !

Thanks for the help everyone. I would do it on IIS, but current IIS doesn't support basic password protection anymore, and we can't do it by IP address.

I'll take a look at implementing the form, but I really want an easy on/off switch for the entire site and hope it doesn't involve changing every page.

Hi,

You're right - it doesn't by default but is very easy to install.

http://www.iis.net/configreference/system.webserver/security/authentication/basicauthentication

Thank you Steve! That works, I thought the feature had been removed from IIS. Additional notes for anyone else searching this thread:

After installing the Basic Authentication feature for IIS, in IIS Manager you need to 1) disable Anonymous Authentication then 2) enable Basic Authentication for your Umbraco site.

Then to view the site need to enter the credentials for an existing Windows user account that exists on that box. (Eg. create a "tester" user & password for this purpose.)

Sorry to resurrect an old thread, but there is a problem with this approach in that you cannot log in to Umbraco once you enable Basic Auth in IIS, as it means (I believe) the Forms Auth required by the Umbraco backoffice no longer works.

If you have found a way in config to accomplish this, it would be great if you could share the info. The simplest alternative is to use Umbraco's in-built Public Access feature (Forms Auth) to password protect the site's front end. I am looking for a more generic solution though.

I did find a interesting article on combining Forms and Windows auth which I am going to try, unless there is an easier way!

I use a simple approach using a partial view which checks if your ip-address is allowed. Otherwise I throw a 404 exception.

If you are on a web hotel, changing ip-security may often be not allowed.

@{

var clientIp = Request.UserHostAddress;


//  Use:  "throw new HttpException(404,"not found");" to deny access

// "::1" is same as localhost


switch(clientIp)
{
    case "::1":
        @*<p>Localhost</p> *@
        break;
    case "127.0.0.1":
        @*<p>Localhost</p> *@
        break;
    case "xx.xxx.xx.xx":
        break;
    case "xx.x.xxx.xxx":
        break;
    default:
         throw new HttpException(404,"not found");      
}
}

FYI For others interested in this topic, I implemented an IIS rewrite rule inspired by Tim Payne's blog post above. My use case is slightly different - the rule simply redirects all requests to the standard Umbraco backoffice login page if the Umbraco login cookie is not present. Neat! Obviously not super secure but enough to satisfy clients that their dev sites are not on public display. #H5YR to Tim Payne!

<rule name="AdminLockout" stopProcessing="true">
          <match url="(.*)" />
          <conditions>
            <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
            <add input="{URL}" pattern="(favicon\.ico|umbraco|webresource|scriptresource)" negate="true" />
            <add input="{HTTP_COOKIE}" pattern="UMB_UCONTEXT=[^;]*" negate="true" />
          </conditions>
          <action type="Redirect" url="/umbraco#/login/false?returnPath=/{R:0}" />
        </rule>

the returnPath didn't work and after logging into Umbraco we would stay there

Yep we have that too. The (relatively) quick but dirty way around it that I came up with is to create a simple plugin with a single html that does a javascript redirect to the front web site.

You can then use the dashboard.config to enable that plugin html just for the user types that you want to immediately redirect. Obviously this will stop them having backoffice access because as soon as the backoffice is displayed for them it redirects away.

Hope it helps

Hah! Ians approach to it is awesome. : )

https://our.umbraco.com/forum/extending-umbraco-and-using-the-api/93378-using-returnpath-with-umbracologin-to-actual-site

is working on a reply...