Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In IIS7.x, does WebDAV only authenticate against Windows accounts?

Do I need to create local windows accounts for each WebDAV user?

Is there a way to use 'IIS Manager Users' instead?

share|improve this question
up vote 1 down vote accepted

You can use Basic Authentication with WebDAV, but the WebDAV redirector will only use Basic authentication with SSL connections.

You use Windows authentication when you want clients to authenticate using the NTLM or Kerberos protocols, so the user needs an Active Directory account.

Basic authentication requires that users provide a valid user name and password to access conten, so in this case you use an local account. However, the disadvantage of Basic authentication is that it transmits unencrypted base64-encoded passwords across the network. You should use Basic authentication only when you know that the connection between the client and the server is secure. The connection should be established either over a dedicated line or by using Secure Sockets Layer (SSL) encryption and Transport Layer Security (TLS). For example, to use Basic authentication with Web Distributed Authoring and Versioning (WebDAV), you should configure SSL encryption.

share|improve this answer
So you still need a local windows account to be able to use Basic Authentication? – Kev Mar 6 '11 at 15:56
Yes, all the HTTP authentication methods, in IIS like Basic, Digest and Integrated are hardwired to Windows accounts. This means that you need a Windows user on your server for every account you want to authenticate. But there is an IIS module which supports also Basic Authentication against Non-Windows Accounts.You then have the ability to do plain Basic Authentication agains account stored e.g. in a database this would be handy in a range of situations like web applications, (WCF) web services, REST services, etc – Guido van Brakel Mar 6 '11 at 16:20
Just to be 100% sure... Basic Authentication + TLS is totally safe? – Wilt Jan 29 at 12:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.