Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a virtual directory that's protected with basic authentication. I'd like to disable authentication for certain IPs, so that all requests from e.g. 127.0.0.1 are allowed without asking for credentials. How can I do this?

share|improve this question

1 Answer 1

up vote 0 down vote accepted

I was unable to find a built-in way to make this happen. I ended up writing an IIS module using the instructions at http://learn.iis.net/page.aspx/170/developing-a-module-using-net/.

The module checks the client's IP address (using HttpRequest.UserHostAddress), and if it is not on the exempt list, re-implements the standard basic authentication for Windows accounts (using the LogonUser API and setting HttpContext.User to a WindowsPrincipal). The authentication domain and list of exempt IP addresses are read from web.config (using ConfigurationManager.AppSettings).

Stumbling blocks included:

  • I wanted to exempt the server itself, so I added 127.0.0.1 and the server's IP address to the exempt list, but also had to add ::1 (IPv6 localhost).
  • I'm using this to protect access to hgweb, and for some reason I had to change the entries in hgrc's allow_push line from username to DOMAIN\username after enabling the plugin.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.