diff --git a/CHANGES.rst b/CHANGES.rst
index eee704a..ad40982 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -5,5 +5,8 @@ Changelog
 1.0a1 (unreleased)
 ------------------
 
+- rejectanonymous (usato ad esempio per /admin nel buildout, vedi anche desing.plone.policy)
+  [mamico]
+
 - Initial release.
   []
diff --git a/setup.py b/setup.py
index 35a6df9..a593a83 100644
--- a/setup.py
+++ b/setup.py
@@ -59,6 +59,7 @@
         "collective.volto.enhancedlinks",
         "collective.feedback",
         "collective.volto.slimheader",
+        "iw.rejectanonymous",
     ],
     extras_require={
         "test": [
diff --git a/src/iosanita/policy/configure.zcml b/src/iosanita/policy/configure.zcml
index be84805..4b13a73 100644
--- a/src/iosanita/policy/configure.zcml
+++ b/src/iosanita/policy/configure.zcml
@@ -44,4 +44,11 @@
 
   <!-- -*- extra stuff goes here -*- -->
 
+  <subscriber
+      for="Products.CMFCore.interfaces.ISiteRoot
+           zope.traversing.interfaces.IBeforeTraverseEvent"
+      handler=".rejectanonymous.insertRejectAnonymousHook"
+      />
+
+
 </configure>
diff --git a/src/iosanita/policy/rejectanonymous.py b/src/iosanita/policy/rejectanonymous.py
new file mode 100644
index 0000000..ead07a6
--- /dev/null
+++ b/src/iosanita/policy/rejectanonymous.py
@@ -0,0 +1,8 @@
+# -*- coding: utf-8 -*-
+from iw.rejectanonymous import rejectAnonymous
+
+
+def insertRejectAnonymousHook(portal, event):
+    """force authentication for request with X-ForceAuth header"""
+    if event.request.getHeader("X-ForceAuth"):
+        event.request.post_traverse(rejectAnonymous, (portal, event.request))