Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to have both windows authentication and basic authentication enabled on one .asmx page in IIS7?

What I want is:

  • Someone calls webservice
  • If possible, use windows authentication (e.g. when calling from another Microsoft based application)
  • If the client doesn't know how to handle windows authentication: allow him to use basic authentication (for example when the client is a program that we can't really modify).
  • If that still doesn't work, send a 401

It looks like - as soon as I enable windows authentication - all basic authentication attempts are ignored / answered with an 401, even though the login credentials worked before I enabled windows authentication.

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

In IIS (website props):

  • Uncheck "Anonymous access"
  • check "Integrated Windows authentication" and "Basic authentication"

Make sure that in web.config you have:

<identity impersonate="true"/>
<authentication mode="Windows" /> 

The default is set to:

<authentication mode="None" />

If "Someone calls webservice" is not on the same machine,
then you will need to configure computer for trusted delegation in AD in order windows authentication to work.

On client's IE
menu Tools--> Internet Options --> Advanced --> under Security check "Integrated Windows Authentication"

share|improve this answer
add comment

This may be overly simplistic, but it seems that you'd have 2 options:

  • Windows & basic users log in via different pages

or

  • Windows users log in with domain\username & basic users log in with servername\username

It's likely the bargain-basement solution, hopefully someone has something better to offer. ;)

share|improve this answer
    
We are already considering the first option. It's a webservice, so we don't really have a log-in page. But we could deploy it twice under different urls. Kind of hackish, though. I don't really understand what you mean with your second option... –  BlaM Aug 25 '10 at 14:45
    
If it's a local account to the IIS box, they can log in with servername\username as their username, to give context - the domain\username works if the user is stored in AD (or presumably any LDAP server that the IIS box understands) –  Kara Marfia Aug 26 '10 at 12:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.