In a web application, that runs MVC4 on an IIS7.5 server (integrated pipeline) using Windows Authentication and a custom role provider, I want to display a custom error page on 401 not authorized errors, if somebody tries to access something they do not have permissions for.
When I debug locally in Visual Studio, the error pages are displayed correctly, and my nice, custom "Not authorized" page shows up as expected.
Deploy to the server - and I get the windows prompt.
Here are the (I think) relevant parts of web.config:
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.web>
<authentication mode="Windows" />
<authorization>
<deny users="?"/>
</authorization>
<roleManager enabled="true" defaultProvider="MyCustomRoleProvider">
<providers>
<clear />
<add name="FimOpsAccessControlRoleProvider" type="Namespace.MyCustomRoleProvider" />
</providers>
</roleManager>
<customErrors mode="On" defaultRedirect="~/Error">
<error redirect="~/Error/Error401" statusCode="401" />
</customErrors>
</system.web>
<system.webServer>
<httpErrors errorMode="Custom" existingResponse="Replace">
<remove statusCode="401" />
<error statusCode="401" path="/error/error401" responseMode="ExecuteURL" />
</httpErrors>
<modules runAllManagedModulesForAllRequests="true" />
</system.webServer>
</configuration>
On the production server, I am able to browse to /error/error401 just fine - and I have also tried replacing that with a static html file and pointing to that, with the same result.
I have tried static error pages, doing stuff in global.asax Application_OnError, every thinkable combination of configurations I could think of in web.config - but with no luck. I have found at least 10 other posts on SO that deals with this problem, but none of the solutions work for me - maybe due to differences in versions, I do not know.
Why is this happening - and how do I get around it?