I have a virtual directory that's protected with basic authentication. I'd like to disable authentication for certain IPs, so that all requests from e.g. are allowed without asking for credentials. How can I do this?

1 Answer 1


I was unable to find a built-in way to make this happen. I ended up writing an IIS module using the instructions by Microsoft.

The module checks the client's IP address (using HttpRequest.UserHostAddress), and if it is not on the exempt list, re-implements the standard basic authentication for Windows accounts (using the LogonUser API and setting HttpContext.User to a WindowsPrincipal). The authentication domain and list of exempt IP addresses are read from web.config (using ConfigurationManager.AppSettings).

Stumbling blocks included:

  • I wanted to exempt the server itself, so I added and the server's IP address to the exempt list, but also had to add ::1 (IPv6 localhost).
  • I'm using this to protect access to hgweb, and for some reason I had to change the entries in hgrc's allow_push line from username to DOMAIN\username after enabling the plugin.
  • Any chance to get the source code or compiled module for this?
    – Uwe Keim
    Apr 24, 2019 at 17:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .