IIS Setup -- Basic Authentication

[jmensch]

Hello,

My company is deploying a web application that needs to be accessible
to some non-Microsoft technologies; as such, we want a setup to secure
our application, but cannot use Windows Integrated Authentication, as
it isn't supported by the service consumer.

I'm having some trouble figuring out how to get Advanced Installer to
configure IIS for Basic Authentication; the check box for it on the IIS
forms doesn't seem to be present in AI, whereas anonymous access and
windows integrated are. Can someone explain how you do this?

[GabrielBarbu]

Hello,

With basic authentication, the user's Web browser transmits
Windows account user names and passwords across the network in plain text.
Malicious users can then intercept this information.

You can use Basic authentication and still protect account information using SSL encryption.

This authentication method has been deprecated with the latest IIS versions.
Advanced Installer does not support this method of authentication. We will however consider adding this method to our IIS TODO list.

Best regards,
Gabriel

[jmensch]

Hello,
With basic authentication, the user's Web browser transmits
Windows account user names and passwords across the network in plain text.
Malicious users can then intercept this information.
You can use Basic authentication and still protect account information using SSL encryption.

Yes, I understand this. We need to use it because of technology requirements on the other end.

This authentication method has been deprecated with the latest IIS versions.

I had not heard this, however. Do you have a reference of some kind about this?

Advanced Installer does not support this method of authentication. We will however consider adding this method to our IIS TODO list.

Thank you for that consideration. Do you know if it is possible to turn it on using the registry or custom actions, or any reference as to how?

[GabrielBarbu]

Hello,

Enabling basic authentication can be achieved only by using a custom action. However, you would have to write the custom action yourself and the process of enabling it is not quite simple.

Best regards,
Gabriel

[cminorm]

I'm setting up a server to use Microsoft Web Replication and it requires Basic authentication using SSL. Does anyone have an example of this custom action to set basic authentication?

[cminorm]

Here is the custom action calls that need to turn on basica authentication

appcmd.exe set config %replsite% -section:system.webServer/security/authentication/basicAuthentication /enabled:"True" /commit:apphost
appcmd.exe set config %replsite% -section:system.webServer/security/authentication/anonymousAuthentication /enabled:"False" /commit:apphost