Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an IIS 7 site set up with its own app pool. The app pool is running as a specific user, and the site is set to run as the app pool identity.

I want to add basic-auth style protection to the site.

I've done this by disabling anon and enabling basic auth in the Site.

However, it seems basic auth causes the site to assume the identity of the windows account used for the basic auth.

Is there any way to prevent this?

I just want to authenticate the web user, I dont want to make IIS run as the account, I want it to remain running as the app pool identity.

Do any of the other authentication options (digest, windows) support this?


p.s. no suggestion of "forms" or "diy" auth in my app, its some legacy code that i just need to quickly protect, thanks

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.