Professional Microsoft IIS 8

Authentication in IIS 8.0

IIS 8.0 provides six authentication options, plus the ability to configure a fixed user identity for connecting to network resources (making seven in total). These are briefly described below. For each authentication mechanism, more detailed information including configuration options, minimum requirements, and potential weaknesses is described subsequently in the chapter. The following authentication mechanisms are supported by IIS 8.0:

• Anonymous authentication—Here the end user does not supply credentials, effectively making an anonymous request. IIS 8.0 impersonates a fixed user account when attempting to process the request (for example, to read the file off the hard disk). This authentication mechanism would be used for public-facing websites where visitors are not required to supply credentials.
• Basic authentication—The end user is prompted to supply credentials, which are then transmitted unencrypted across the network. Basic authentication was originally defined in RFC 1945 (the HTTP 1.0 specification) and is thus supported in all current browsers. Although the user's password is BASE64-encoded, it is not encrypted, requiring a separate technology to secure the password (e.g., TLS or IPSec).
• Digest authentication—The end user is prompted to supply credentials, but unlike in Basic authentication, the user's password is not passed in cleartext across the network. Digest authentication was originally defined in RFC 2069 and updated in RFC 2619. Digest ...