I have a virtual directory that's protected with basic authentication. I'd like to disable authentication for certain IPs, so that all requests from e.g. are allowed without asking for credentials. How can I do this?


I was unable to find a built-in way to make this happen. I ended up writing an IIS module using the instructions by Microsoft.

The module checks the client's IP address (using HttpRequest.UserHostAddress), and if it is not on the exempt list, re-implements the standard basic authentication for Windows accounts (using the LogonUser API and setting HttpContext.User to a WindowsPrincipal). The authentication domain and list of exempt IP addresses are read from web.config (using ConfigurationManager.AppSettings).

Stumbling blocks included:

  • I wanted to exempt the server itself, so I added and the server's IP address to the exempt list, but also had to add ::1 (IPv6 localhost).
  • I'm using this to protect access to hgweb, and for some reason I had to change the entries in hgrc's allow_push line from username to DOMAIN\username after enabling the plugin.
|improve this answer|||||
  • Any chance to get the source code or compiled module for this? – Uwe Keim Apr 24 '19 at 17:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.