HOW TO: Configure Internet Information Services Web Authentication in Windows Server 2003

This step-by-step article describes how to configure authentication for Web-based requests in Microsoft Internet Information Services (IIS) 6.0.

How Web Authentication Works

Web authentication is a communication between the Web browser and the Web server that involves a small number of Hypertext Transfer Protocol (HTTP) headers and error messages.

The flow of communication is as follows:

1. The Web browser makes a request, such as HTTP-GET.
2. The Web server performs an authentication check. If this is not successful because authentication is required, the server responds with an error message similar to the following:
   You are not authorized to view this page
   
   You do not have permission to view this directory or page using the credentials you supplied.
   Information is included in this message that the Web browser can use to resubmit the request as an authenticated request.
3. The Web browser uses the server's response to construct a new request that contains authentication information.
4. The Web server performs an authentication check. If the check is successful, the Web server sends the data that was initially requested back to the Web browser.

Authentication Methods

Note: With some of the following authentication methods, you must use drives that you have formatted with the NTFS file system because NTFS-formatted drives maintain the highest level of security.

IIS supports the following Web authentication methods.

Anonymous Authentication

IIS creates the IUSR_ComputerName account (where ComputerName is the name of the server that is running IIS) to authenticate anonymous users when they request Web content. This account gives the user the right to log on locally. You can reset anonymous user access to use any valid Windows account.

Note: You can set up different anonymous accounts for different Web sites, virtual directories or physical directories, and files.

If the Windows Server 2003-based computer is a stand-alone server, the IUSR_ComputerName account is on the local server. If the server is a domain controller, the IUSR_ComputerName account is defined for the domain.

Basic Authentication

Use basic authentication to restrict access to files on an NTFS-formatted Web server. With basic authentication, the user must enter credentials, and access is based on the user ID. Both user ID and password are sent across the network in clear text.

To use basic authentication, grant each user the right to log on locally, and to make administration easier, add each user to a group that has access to the necessary files.

Note: Because user credentials are encoded with Base64 encoding but they are not encrypted when they are transmitted over the network, basic authentication is not considered a secure form of authentication.

Windows Integrated Authentication

Windows Integrated authentication is more secure than basic authentication, and it functions well in an intranet environment where users have Windows domain accounts. In integrated Windows authentication, the browser tries to use the current user's credentials from a domain logon, and if this attempt is unsuccessful, the user is prompted to enter a user name and password. If you use integrated Windows authentication, the user's password is not transmitted to the server. If the user has logged on to the local computer as a domain user, the user does not have to authenticate again when the user accesses a network computer in that domain. Note that you must use Microsoft Internet Explorer 2.0 or later as your Web browser if you are using Windows Integrated authentication.

Note: You cannot use integrated Windows authentication through a proxy server.

Digest Authentication

Digest authentication addresses many of the weaknesses of basic authentication. The password is not sent in clear text when you use digest authentication. Additionally, you can use digest authentication through a proxy server. Digest authentication uses a challenge/response mechanism (which integrated Windows authentication uses) where the password is sent in an encrypted format. To use digest authentication, note the following requirements:

• The user and IIS server must be members of, or trusted by, the same domain.
• Users must have a valid Windows user account stored in Active Directory on the domain controller.
• The domain must use a Microsoft Windows 2000-or-later domain controller.
• You must install the IISSuba.dll file on the domain controller. This file is copied automatically during Windows 2000 Setup or Windows Server 2003 Setup.
• You must configure all user accounts with the Store password using reversible encryption account option selected. To select this account option, the password must be reset or re-entered.

Note: You must use Microsoft Internet Explorer 5.0 or later as your Web browser if you are using digest authentication.

.NET Passport Authentication

Microsoft .NET Passport is a user-authentication service that permits single sign-in security, which provides users with security-enhanced access to .NET Passport-enabled Web sites and services. .NET Passport-enabled sites rely on the .NET Passport central server to authenticate users. However, the central server does not authorize or deny a specific user's access to individual .NET Passport-enabled sites. It is the responsibility of the Web site to control users' permissions. When you select this option, requests to IIS must contain valid .NET Passport credentials on either the query string or in the cookie. If IIS does not detect .NET Passport credentials, requests are redirected to the .NET Passport logon page.

Client Certificate Mapping

Client certificate mapping is a method where a mapping is created between a certificate and a user account. In this model, a user presents a certificate and the system looks at the mapping to determine which user account should be logged on. You can map a certificate to a Windows user account in one of two ways:

• By using Active Directory.
  
  -or-
• By using rules that are defined in IIS.

For additional information about how to map client certificates to user accounts, search on "Client Certificate Mapping" in the IIS documentation. If you have IIS installed, you can access the Help files by either of the following methods:

• Right-click any node in Internet Service Manager, and then click Help.
  
  -or-
• Start Windows Explorer, locate the hard disk:\Windows\Help folder, and then open Lismmc.chm.