Re: Diff behavior for "Integrated windows authentication" in IIS6

IIS6 Integrated Windows Authentication works just like IIS5.

If you find a difference in behavior, it is most likely due to
difference in user configuration between the Windows 2000 Server and
Windows Server 2003 machines.

Anonymous authentication in all versions of IIS means: "for all
requests, logon a specified user account in IIS configuration and use
that user account to execute the request". It has no relation to
"anonymous user on the Intranet". It means that EVERY user from
anywhere uses the specified user account in IIS configuration to
execute requests on the server.

Integrated Windows authentication in all versions of IIS means: "For
all requests, negotiate an acceptable authenication protocol to confirm
the identity of a Windows user principle, and use that user's token to
execute the request."

If you want do disallow "anonymous" access, then turn off Anonymous
authentication in IIS, and make sure your resources are ACL'd to the
right users and groups.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//



David Zhu wrote:
Hi Roger,

Thank. After further investigation, I found that I neglect a quite important
thing before. The ACL of my Web Application follow allows the "Domain Users"
to read and execute. So I think that allowst the anonymous domain user access
my web
application.

Thanks again.


"Roger Abell [MVP]" wrote:

You need to provide more precise details.
It is not just whether Windows integrated authentication is or is
not enabled for use, but also what permissions exist on the content
that determines what access happens. The account used for the
application pool does not really alter the authentication behavior
when the browser hits on the site.

"David Zhu" <DavidZhu@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:487A0A8C-AA7F-4C05-915C-137F378DA605@xxxxxxxxxxxxxxxx

Hi,

I'm quite confused by the behavior of IIS6's "Integrated windows
authentication"!

Because when I specify an admin account as the Identity of the application
pool which my web application used. Then, even an anounymous user in the
intranet
would be able to access my application, and in the meanwhile I didn't
enable
the anounymous access in IIS6.

But this case, would never happenned in IIS5, because as we know that
other
users who did not have the priviledge to access the server, would not be
able
to
access my web application when "Integrated windows authentication" be
enabled only.

Please help me, thanks.






.

Relevant Pages

  • Re: Windows Integrated and the domain name
    ... Both NTLM and Kerberos authentication require the full realm and username - that's unfortunately the way both of those two protocols work. ... for a direct integrated windows authentication ... Microsoft Online Community Support ...
    (microsoft.public.inetserver.iis.security)
  • Re: Using IIS w/ASP .NET 2.0 Web Application Projects
    ... If you select Windows Integrated Authentication, anonymous users won't be able to login. ... ASP.NET has a *separate* authentication configuration which IIS doesn't interfere with. ... Integrated Windows Authentication overrides the Anonymous authentication default. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Using IIS w/ASP .NET 2.0 Web Application Projects
    ... if you enable Windows Integrated Authentication, ... See my previous post for more details regarding use of Windows Authentication with ASP.NET. ... at least within non-ASP.NET IIS applications. ... Integrated Windows Authentication overrides the Anonymous authentication default. ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Integrated Windows Authentication
    ... NTLM authentication, both of which are represented by Windows Integrated. ... to the resource is not a member of the same domain as the web server. ... |>Subject: Integrated Windows Authentication ...
    (microsoft.public.inetserver.iis.security)
  • Re: How can I avoid using SQL Authentication with the Office Web Parts?
    ... That does not sound like Office Web Parts ignoring impersonation. ... your logged on user credentials as authentication. ... Exposing any functionality on a server creates a security risk. ... If I log into my machine using one domain user account and then log into the ...
    (microsoft.public.office.developer.web.components)