Groups | Blog | Home
all groups > dotnet security > july 2006 >

dotnet security : Authentication method ??


serge calderara
7/27/2006 5:21:02 AM
Dear all,

When you check the authentication method for a web site under IIS
configuration, by default it has the Enable Anonymous Acces and Integrated
Windows Authentication set.

If you have the Integarted Windows Authenticatin set, it means for me that
you absolutly need to provide correct user information.

So why the Anonymous Access is also set ? what is the meaning of having it
as well as windows identification ?

Thnaks for your help
regards
oldbear
7/27/2006 6:42:01 AM
Hi

You can select both anonymous and Wondows Integrated together. In this case,
when a user accesses your site, IIS will first attempt to access the relevant
resources using the anonymous account.

If either of the following happens:
anonymous fails;
resources are protected by NTFS permissions which do not allow access by the
anonymous account

then IIS will then attempt to authenticate via Windows Integrated.

http://www.microsoft.com/windows2000/en/server/iis/default.asp?url=/windows2000/en/server/iis/htm/core/iiauths.htm

One model used to allow anonymous access access to certain pages and
restrict access to others is to set these two options (anonymous and
integrated) in IIS, then grant or deny anonymous access to resources via NTFS
permissions.

Hope this helps


--
----------------------------------
Chris Seary
http://blog.searyblog.com/




[quoted text, click to view]
Nicole Calinoiu
7/27/2006 9:43:32 AM
If you use both authentication mechanisms for a site (or virtual directory
or file), anonymous will be used until the user requests a resource that the
anonymous-mapped user is not authorized to access. When the server sends a
401 response to the client for the protected resource, it will indicate that
your selected Windows authentication mechanism should be used.


"serge calderara" <sergecalderara@discussions.microsoft.com> wrote in
message news:9DBED855-C9C2-4DD8-9C97-70593D675DEB@microsoft.com...
[quoted text, click to view]
serge calderara
7/27/2006 12:20:02 PM
Thnaks to both of you. sounds really clear for me now.
I did not know that type of behaviour

[quoted text, click to view]
AddThis Social Bookmark Button