Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to protect certain folders or sites in IIS7 with a basic authentication user, that is NOT in windows. I tried adding users in the user manager and allowing them, but it does not accept the user.

I do not want to write a custom auth, I just want the same feature apache offers since version 0.1

share|improve this question
up vote 2 down vote accepted

Not out of the box - some development, or use of another module, is required. Forms-based authentication is closest, but you'd need to establish the forms user identities, by default in the membership database.

Alternatively, some assembly required:

Or you could find a Basic authentication module that works against a simple list of usernames & passwords.


share|improve this answer
Thanks, but some are normal folders with content and some others are website for customers, that's why it's a problem, cannot do anything in the code. – YesMan85 Sep 15 '11 at 11:49
not in "the" website code, you'd create a module (or just enable Forms auth for random content) and plug it into the pipeline on the server, just like IIS does with all its components these days. Then it doesn't matter what content's in there, or what code it's going to execute. Or at least, not more than it would have if IIS did offer an option like that. – TristanK Sep 15 '11 at 12:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.