Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way in IIS to enable basic authentication for remote requests while leaving the website open for local requests? I need external users to authenticate to access a site, but users on the local machine should not have to.

share|improve this question
Is the IIS server a member of an AD domain? – joeqwerty Sep 12 '12 at 2:13
@joeqwerty no it is not. – Chev Sep 12 '12 at 3:16
Well then there's no such thing as a local request, unless users are browsing the site from the IIS server itself. As a standalone server, the server has it's own SAM database, local to itself. Any user browsing the site from any other computer is "external" to the local SAM database of the IIS server. Is it the case that users will be browsing the site from the IIS server itself? – joeqwerty Sep 12 '12 at 3:30
That's what I mean, from the server itself. It's actually another application running on the server that needs to access it. Regardless, the request is coming from – Chev Sep 12 '12 at 3:40
OK, got it. How about enabling Integrated Windows Authentication? Would that not allow "local" sessions to be authenticated without prompting while forcing "external" sessions to be authenticated? I'm assuming that the application runs under a user context and that the user has the appropriate permissions for the site. IWA would still be authenticating all users accessing the site but it would be transparent for local users (at least it would if it were actual users, it may not work with your application but it's worth a try). – joeqwerty Sep 12 '12 at 4:00

Why not set up one site bound to the Server's IP using Basic Authentication and a second site bound only to configured to use Anonymous Authentication and pointing to the same content directories? This way users hitting the site from off he box get prompted becuase they are hitting the site using Basic and local requests hit the site on the loopback address using Anonymous?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.