IIS Server Security >> Basic authentication help needed

by cal » Wed, 11 Feb 2004 19:21:41 GMT

Can someone direct me to directions to set up basic win
authentication on a webpage running IIS 6?

We want to make it so that when users go to a site, they
get prompted for their windows username and password
before they can see the page.

We set something up but I think we did it wrong because,
they user always gets promted for the domain as well as
their username and passwrd (we dont want that option to
show up) plus I noticed that when a user is on XP, it
works differently then if a user is on a Win 2000 box.

please help.




IIS Server Security >> Basic authentication help needed

by Ken Schaefer » Wed, 11 Feb 2004 20:13:38 GMT


Default IE on Windows 2000 prompts for Domain, Username and Password.
Default IE on WindowsXP prompts for Username and Password only (but they
need to supply user@domain or Domain\Username).

In IIS you can configure the default domain in the Basic Authentication
settings, and I believe the user can leave out their domain in that case
(just leave it blank). That said, Basic Authentication is insecure unless
you are using SSL to secure the transmission.

Cheers
Ken



: Can someone direct me to directions to set up basic win
: authentication on a webpage running IIS 6?
:
: We want to make it so that when users go to a site, they
: get prompted for their windows username and password
: before they can see the page.
:
: We set something up but I think we did it wrong because,
: they user always gets promted for the domain as well as
: their username and passwrd (we dont want that option to
: show up) plus I noticed that when a user is on XP, it
: works differently then if a user is on a Win 2000 box.
:
: please help.
:
:





Similar Threads

1. basic help needed on using members in asp pages

I have the following ASP.NET page :

<!-- event.aspx -->
<%@ Page Language="C#" %>
<html>

<script runat=server>
protected int counter;
protected void OnClickMyButton(object src, EventArgs e)
{
  counter++;
  _message.InnerText = "You clicked the button " + counter + "
times!";
}
protected void Page_Init(object src, EventArgs e)
{
  _MyButton.ServerClick += new EventHandler(OnClickMyButton);
}
</script>

<body>
  <form runat=server ID="Form1">
    <h2>ASP.NET event page</h2>
    <p>
    <input type=button id=_MyButton value="Click me!" runat=server
NAME="_MyButton"/>
    </p>
    <span id=_message runat=server/>
  </form>
</body>
</html>


I expect that each time i click on the button, a new HTTP GET method
is sent to the server and the click event would call the
OnClickMyButton method which would increase the value of the counter
on each click.
But the counter never gets incremented, then I believe that i
misunderstand something in the mechanism, either the counter loose his
value between each click or after the first click the event does not
occur anymore or ... i don't tknow...
Please could u explain me how to keep a value between different call
of the same page? And what is the real mechanism each time that i
click on the button?

Thank you.

Francois

2. Basic Frontpage / ASP help needed

3. Need basic help authenticating remote wmi call from an asp webpage

Hi all,
I am attempting to create a web-page that will check several servers and 
verify that the local admin account has been renamed properly. I've written 
a .vbs (command file) to do it - I have the necessary rights on each 
server - and it works just fine (portion shown below)

My problem is converting it to an asp web page. When I try, I always get a 
security failure. I've checked and the page is running under a domain id 
with admin rights to the servers. I am assuming its something I just can't 
find the answer to, about the way ASP handles security impersonation. Can 
someone point me to where I need to look?



Original .vbs code (which works)

    Set WmiObjSet = GetObject("winmgmts:\\" & strComputer)
    Set colItems = WmiObjSet.ExecQuery ("Select * from Win32_Account)


Code in test.asp which fails with:           Permission Denied: 'GetObject'

    Response.Write Request.ServerVariables("LOGON_USER")
    set IPConfigSet = GetObject("winmgmts://xxxxxxxxxxxx").ExecQuery("SELECT 
* from Win32_Account")


Based on some examples on MSDN, I have also tried (with no luck):

    set IPConfigSet = 
GetObject("winmgmts:{impersonationLevel=impersonate}!//xxxxxxxxxxxx/root/cimv2").ExecQuery("SELECT 
* from Win32_Account")

    set IPConfigSet = 
GetObject("winmgmts:{impersonationLevel=delegate,authority=ntlmdomain:xxxx}//xxxxxxxxxxxx/root/cimv2").ExecQuery("SELECT 
* from Win32_Account")


Any help would be greatly appreciated
Mark

4. IIS6.0 + Win2003: Need basic 101 help

5. naive newby with no money needs really basic web site help

I have downloaded a freeware website. There is a considerable community
around this software and I have seen it used in many variations, but I
can't even make it show up on my server. I keep getting a 'cannot find
server' message. After following the Web site creation wizard on iis I
right clicked the name of my new site and one of the options is
'browse'. But clicking on that STILL gets me the 'cannot find server'
message. This is so frustrating. If there is something else I am
supposed to be doing, why doesn't the #%$&# wizard say so? Isn't the
whole point of wizards to make this stuff easy?

Does the fact that there is already a site on here* (not set up by me)
make any difference? I understand it isn't suppposed to, since IIS is
supposed to let you run and develop multiple sites, but I can't get it
through localhost, either.

ANY advice HUGELY welcome.

*I don't want to make this post any longer than it needs to be to get
help, but by way of background, if it matters, the whole reason I have
a server in the first place is because I licensed some software that
requires I not use a hosting company - because some idiot at a hosting
facility in the past spread their software around for his own profit -
so I thought since I had the hardware anyway why not use it to host the
other parts of the site? That was the logic, anyway. And I have hired
an IT firm, but quite frankly they are expensive and in the three times
they have sent someone over here it has never been the same guy, which
I don't find particularly comforting, and besides, now I'm broke (just
when I need this thing to work...)

I have also been scouring the web and the library trying to find a
really basic book, primer, or other resource to walk me through this
but so far nothing. Any ideas on that end welcome, too.

6. Need Basic Help w/IIS 5's Indexing Program.... - Index Server

7. IIS With Basic Authentication Set/FormsAuthentication - HELP PLS!?

Hi everyone,

  First off, sorry for the cross-post...

  I am developing a site (ASP.NET) in which the root will be set with 
Anonymous AND/OR Basic permissions.  Past that I will have an application 
(directory) in which I will be developing applications, which will have IIS 
Basic Authentication set (this can't be avoided).  In the past, I have been 
able to use a ISAPI Filter to add the response headers dynamically, and add 
the authentication to the request, therefore, allowing users into the secure 
directory, and all of this is form based, there is no browser prompt for 
their username/password (and it adds it to every request, images, .htm 
files, .asp files, etc).  Now I am trying to do this with ASP.NET (VB), 
again, trying to avoid the browser prompt, and add the authentication to 
every request (again, images, .htm files, aspx files, etc).  However, I have 
been unsuccessful using FormsAuthentication with the directory set to IIS 
Basic Authentication (since IIS sees the request first, I get a browser 
prompt. I want to replace this with a redirect to a login form).  I have 
been able to get the FormsAuthentication to set the cookie, but when it 
tries to go into the Basic secured directory, I get a browser prompt.  Any 
help would be greatly appreciated!! (Do I need to write another ISAPI 
Filter, can I use FormsAuthentication to do this??  Suggestions?)

  I have looked at hundreds of articles (or at least it seems!), and am not 
100% how to write an ISAPI filter in .NET, if that needs to be done.  Any 
pointers to live artices, code, etc. would be very helpful.

  Overall, basically, I want to use Basic Authentication protocol and 
FormsAuthentication to access an IIS-set Basic Authentication directory, but 
I want to use a form instead of the normal windows logon prompt.  Our users 
share computers, so having them being able to "save their password" is a 
major security concern, which is why I need a login form page.

Thanks!

Chad 


8. Basic Authentication or NT Authentication on Windows Vista (Business)