I have a virtual directory that's protected with basic authentication. I'd like to disable authentication for certain IPs, so that all requests from e.g. 127.0.0.1 are allowed without asking for credentials. How can I do this?
I was unable to find a built-in way to make this happen. I ended up writing an IIS module using the instructions by Microsoft.
The module checks the client's IP address (using
HttpRequest.UserHostAddress), and if it is not on the exempt list, re-implements the standard basic authentication for Windows accounts (using the
LogonUser API and setting
HttpContext.User to a
WindowsPrincipal). The authentication domain and list of exempt IP addresses are read from
Stumbling blocks included:
- I wanted to exempt the server itself, so I added
127.0.0.1and the server's IP address to the exempt list, but also had to add
- I'm using this to protect access to hgweb, and for some reason I had to change the entries in
DOMAIN\usernameafter enabling the plugin.