Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to have both windows authentication and basic authentication enabled on one .asmx page in IIS7?

What I want is:

  • Someone calls webservice
  • If possible, use windows authentication (e.g. when calling from another Microsoft based application)
  • If the client doesn't know how to handle windows authentication: allow him to use basic authentication (for example when the client is a program that we can't really modify).
  • If that still doesn't work, send a 401

It looks like - as soon as I enable windows authentication - all basic authentication attempts are ignored / answered with an 401, even though the login credentials worked before I enabled windows authentication.

share|improve this question
up vote 4 down vote accepted

In IIS (website props):

  • Uncheck "Anonymous access"
  • check "Integrated Windows authentication" and "Basic authentication"

Make sure that in web.config you have:

<identity impersonate="true"/>
<authentication mode="Windows" /> 

The default is set to:

<authentication mode="None" />

If "Someone calls webservice" is not on the same machine,
then you will need to configure computer for trusted delegation in AD in order windows authentication to work.

On client's IE
menu Tools--> Internet Options --> Advanced --> under Security check "Integrated Windows Authentication"

share|improve this answer

This may be overly simplistic, but it seems that you'd have 2 options:

  • Windows & basic users log in via different pages


  • Windows users log in with domain\username & basic users log in with servername\username

It's likely the bargain-basement solution, hopefully someone has something better to offer. ;)

share|improve this answer
We are already considering the first option. It's a webservice, so we don't really have a log-in page. But we could deploy it twice under different urls. Kind of hackish, though. I don't really understand what you mean with your second option... – BlaM Aug 25 '10 at 14:45
If it's a local account to the IIS box, they can log in with servername\username as their username, to give context - the domain\username works if the user is stored in AD (or presumably any LDAP server that the IIS box understands) – Kara Marfia Aug 26 '10 at 12:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.