0

Is it possible to have both windows authentication and basic authentication enabled on one .asmx page in IIS7?

What I want is:

  • Someone calls webservice
  • If possible, use windows authentication (e.g. when calling from another Microsoft based application)
  • If the client doesn't know how to handle windows authentication: allow him to use basic authentication (for example when the client is a program that we can't really modify).
  • If that still doesn't work, send a 401

It looks like - as soon as I enable windows authentication - all basic authentication attempts are ignored / answered with an 401, even though the login credentials worked before I enabled windows authentication.

BlaM
  • 3,816
  • 5
  • 26
  • 27

2 Answers2

4

In IIS (website props):

  • Uncheck "Anonymous access"
  • check "Integrated Windows authentication" and "Basic authentication"

Make sure that in web.config you have: 

<identity impersonate="true"/>
<authentication mode="Windows" />

The default is set to: 

<authentication mode="None" />

If "Someone calls webservice" is not on the same machine,
then you will need to configure computer for trusted delegation in AD in order windows authentication to work.

On client's IE
menu Tools--> Internet Options --> Advanced --> under Security check "Integrated Windows Authentication"

Gennady Vanin Геннадий Ванин
  • 677
  • 3
  • 12
  • 28
1

This may be overly simplistic, but it seems that you'd have 2 options:

  • Windows & basic users log in via different pages

or

  • Windows users log in with domain\username & basic users log in with servername\username

It's likely the bargain-basement solution, hopefully someone has something better to offer. ;)

Kara Marfia
  • 7,892
  • 5
  • 32
  • 56
  • We are already considering the first option. It's a webservice, so we don't really have a log-in page. But we could deploy it twice under different urls. Kind of hackish, though. I don't really understand what you mean with your second option... – BlaM Aug 25 '10 at 14:45
  • If it's a local account to the IIS box, they can log in with servername\username as their username, to give context - the domain\username works if the user is stored in AD (or presumably any LDAP server that the IIS box understands) – Kara Marfia Aug 26 '10 at 12:28