User Authentication in IIS
Overview on IIS User Authentication
Authenticating users in IIS is one of the initial steps in securing IIS. When a user attempts to access a Web site or a FTP site on an IIS machine, authentication is the process which verifies whether the user can indeed access the site. Authentication and permissions are closely coupled. After a user is authenticated, NTFS permissions determine whether the user can access folders and files, and Web permissions indicate whether a Web client or FTP client can read the home directory or virtual directory of the website.
The authentication methods which can be used to authenticate users in IIS 6 are listed below. Each authentication method can be used to authenticate users attempting to access Web sites. However, only Anonymous access and Basic Authentication can be enabled for FTP sites.
- Anonymous access
- Basic Authentication
- Integrated Windows Authentication
- Digest Authentication
- .NET Passport Authentication
You can configure an authentication method for a Web site at the following levels:
- Web Sites node: The Directory Security tab is used.
- Specific websites: The Directory Security tab is used.
- Virtual directory: The Directory Security tab is used
- Specific files: The File Security tab is used
You can configure an authentication method for a FTP site at the following levels:
- FTP Sites node: The Security Accounts tab is used.
- Specific FTP site: The Security Accounts tab is used
When more than one authentication method is configured for a website, virtual directory or a file; the order in which the authentication methods supported in IIS are applied, is listed below:
- The Anonymous access authentication method is applied first.
- When the Anonymous access authentication method is not configured or supported, then the Windows Integrated Authentication method is attempted, the Digest Authentication method is attempted next, and the Basic Authentication method is attempted last (in that order).
- No other authentication methods are available when the .NET Passport Authentication method is configured.
The Integrated Windows Authentication method is the standard authentication method utilized for authenticating users attempting to log on to a Windows 2000 or Windows Server 2003 computer or network. Integrated Windows Authentication is the recommended authentication method for authenticating users attempting to access Web sites and FTP sites on IIS machines.
Integrated Windows Authentication consists of the following two methods of the authentication:
- The NTLMv2 method is used when the IIS machine is running in a network that contains Windows NT domain controllers, or when the IIS machine belongs to a workgroup.
- Kerberos authentication is used when the IIS machine belongs to a domain – no Windows NT domain controllers exist.
The requirements of the Integrated Windows Authentication method are listed below:
- Internet Explorer 3.01 or later
- Integrated Windows Authentication could experience problems with firewalls and proxy servers. You may therefore need to configure Web clients to access the Web server through a tunneled connection, such as Point-to-Point Tunneling Protocol (PPTP).
Digest Authentication can only be enabled if Active Directory is used. Digest Authentication sends the user credentials over the network by utilizing an encrypted MD5 hash, and is therefore more secure than the Basic Authentication method.
The requirements of the Digest Authentication method are listed below:
- Internet Explorer 5 or later
- Active Directory must be used with domain controllers running Windows 2000 or Windows Server 2003.
- Domain user accounts must be configured for users.
- Users and the IIS machine should belong to the same domain. If not, they should be trusted by the same domain.
- The LocalSystem account must be used by the IIS machine when worker process isolation mode is enabled.
Basic Authentication is considered the most insecure authentication method that can be used for authenticating users in IIS because it uses a clear-text username and password. Basic Authentication functions over proxy servers, and works with all browser clients. Basic Authentication is enabled for FTP sites, by default.
With .NET Passport Authentication, .NET passports are utilized for authentication, and authentication occurs via a single sign on method. When enabled, the credentials of users have unique Passport accounts. The Passport accounts are located on Passport servers which are connected to the Internet. The Passport servers are managed by Microsoft. IIS sends the Passport information of the user to the Passport servers for authentication when a user attempts to access an IIS Web site.
The steps that should be used to enable .NET Passport Authentication is listed below:
- You first have to set up a site ID and all necessary Passport configuration settings on the IIS machine. You can use the Passport Manager Administration Utility, msppcnfg.exe, to perform this task.
- You next have to acquire a server certificate for the Web site. This certificate would identify the Web site when user authentication requests are forwarded to the Passport servers.
- You have to register the Web site with the Passport site of Microsoft.
How to configure authentication settings at the Web site level
- Open the IIS Manager.
- Right-click a Web site in the console tree, and select Properties from the shortcut menu.
- When the Properties dialog box of the Web site opens, click the Directory Security tab.
- In the Authentication and Access Control section of the Directory Security tab, click the Edit button.
- The Authentication Methods dialog box opens. You can configure the settings listed below on this dialog box.
- The Enable anonymous access checkbox can be enabled or disabled for the Web site. Anonymous access is typically used for public sites.
- The options which you can configure in the Authenticated Access area of the Authentication Methods dialog box are:
- Integrated Windows Authentication: This is the most secure option that can be used for authentication in IIS. Kerberos version 5 is utilized if the client browser includes support for the protocol. NTLM authentication is used when the client browser does not support Kerberos version 5.
- Digest Authentication For Windows Domain Servers: This option can only be enabled if Active Directory is used. Digest Authentication sends the user credentials over the network by utilizing an encrypted MD5 hash.
- Basic Authentication: This is the weakest authentication method available for IIS, and should be utilized when you cannot use any other authentication method. Basic authentication uses a clear-text username and password.
- .NET Passport Authentication: When enabled, .NET passports are utilized for authentication, and authentication occurs via a single sign on method.
- Click OK
How to configure an authentication method at the FTP site level
- Open the IIS Manager.
- Right-click a FTP site in the console tree, and select Properties from the shortcut menu.
- When the Properties dialog box for the FTP site opens, click the Security Accounts tab.
- The Security Accounts tab has the following two checkboxes:
- Allow Anonymous Connections
- Allow Only Anonymous Connections
- If you only want to enable the Anonymous Access authentication method, select both the Allow Anonymous Connections checkbox, and the Allow Only Anonymous Connections checkbox.
- If you want to enable both the Anonymous Access authentication method and the Basic authentication method, only select the Allow Anonymous Connections checkbox. Anonymous Access authentication will be automatically attempted before Basic authentication is attempted.
- If you only want to enable Basic authentication, ensure that the Allow Anonymous Connections and Allow Only Anonymous Connections checkboxes are cleared (not selected).
- Click OK
How to configure authentication settings at the IP Address level
You can restrict Web access at the IP address level by only allowing users to access a site who are using an IP address from a predefined list of approved IP addresses.
To do this,
- Open the IIS Manager.
- Right-click a Web site in the console tree, and select Properties from the shortcut menu.
- When the Properties dialog box of the Web site opens, click the Directory Security tab.
- In the IP Address and Domain Name Restrictions section of the Directory Security tab, click the Edit button.
- The Address and Domain Name Restrictions dialog box opens.
- Using the dialog box, you can specify that all computers are granted access, or you can specify those computers which should not be granted access by listing their IP address or domain name.
- Click the Add button to include particular users’ IP addresses in a list.
- Click OK.
Find more guides about computer network just visit and find Complete Computer Networking Guide Also Read here Online Money Making Tips
|
|
|
Bookmark User Authentication in IIS
