all groups > iis security > october 2004 >
You're in the

iis security

group:

Newbie Windows Authentication, IIs and Intranet vs Internet users.


Re: Newbie Windows Authentication, IIs and Intranet vs Internet users. Tom Kaminski [MVP]
10/6/2004 8:29:22 AM
iis security:
[quoted text, click to view]

See these links:

IIS 5 Documentation
http://www.microsoft.com/windows2000/en/server/iis/
Microsoft Internet Information Server
Administration
Server Administration
Security
Authentication
Access Control

IIS 6 Documentation
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/proddocs/standard/gs_authentication.asp


HOW TO: Configure IIS 5.0 Web Site Authentication in Windows 2000
http://support.microsoft.com/?id=310344

HOW TO: Configure User and Group Access on an Intranet in Windows 2000 or
Windows NT 4.0
http://support.microsoft.com/?id=325358

HOW TO: Configure IIS Web Site Authentication in Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;324274

HOW TO: Configure Internet Information Services Web Authentication in
Windows Server 2003
http://support.microsoft.com/default.aspx?scid=kb;en-us;324276

How To Secure an ASP.NET Application by Using Windows Security
http://support.microsoft.com/default.aspx?scid=kb;EN-US;315736

How do I get my visitors' login name / username?
http://www.aspfaq.com/show.asp?id=2046

[quoted text, click to view]

As Ken said, don't do that.

[quoted text, click to view]

a) yes.
b) yes.

[quoted text, click to view]

They would need to manually provide their credentials.

--
Tom Kaminski IIS MVP
http://www.microsoft.com/windowsserver2003/community/centers/iis/
http://mvp.support.microsoft.com/
http://www.iisfaq.com/
http://www.iistoolshed.com/ - tools, scripts, and utilities for running IIS
http://www.tryiis.com

Newbie Windows Authentication, IIs and Intranet vs Internet users. Gramps
10/6/2004 1:48:00 PM
Hi,


My requirement is to verify that a Windows logged-on user is permitted to
access a given intranet application hosted on IIS

I am to write this Web app.

1) Is there a best practice approach to this?
2) Do user accounts get stored in Db of the new web app? If so, how is this
affected by a user changing their Windows password?

3) I've read doco on authentication, anonymous etc and determined that if
web application is accessed only from the company intranet then Windows
Authentication seems possible and without storing account info locally to
new web app.
- Is this correct?
- Can the web app be restricted to certain users rather than all valid
windows accounts?


4) How does windows authentication fit with those users at home say, with a
dial-up internet connection, trying to access the web app?


Thanks.



Re: Newbie Windows Authentication, IIs and Intranet vs Internet users. Ken Schaefer
10/6/2004 2:54:32 PM
The easiest way to do this is to:

a) Change the IIS configuration to not allow "anonymous authentication", and
require some other kind of authentication instead (eg Basic, Integrated,
Digest). Read this for more information:
http://www.adopenstatic.com/resources/books/293_CYA_IIS6_05.pdf

b) Change your Application Programming Environment to use IIS'
authentication system. For ASP apps you don't need to do anything. For
ASP.NET apps, you can toggle Windows authentication on in your web.config
file. If you are using Cold Fusion or something else you may need to take
other steps.

Cheers
Ken

[quoted text, click to view]

AddThis Social Bookmark Button