IIS 7.5 Basic Authentication

ASP.NET Version:

You configure the ASP.NET version on IIS7.x on the application pool that the site is running in. To find what pool your site is running in, select the site in IIS Manager and select Advanced Settings in the right hand Actions pane. This will pop up a window like this:

Jot down the name of the Application Pool then close this popup dialogue.

Navigate and open the Application Pools feature in IIS Manager. Select and right click on the application pool noted above then select Advanced Settings:

I've highlighted three settings:

.NET Framework Version - this is a dropdown where you can choose which .NET Framework to run

Enable 32-Bit Applications - if you're running a 64 bit version of Windows 7 or 2008R2 then this option will be important if your application consumes 32 bit only components. Even if it doesn't, knocking the pool back to 32 bit more can be useful when trouble shooting mysterious failures.

Managed Pipeline Mode - IIS supports two types of pipeline now. Classic and Managed. If your application is being migrated from IIS5.x or 6 then I'd start off by changing the pool to run in Classic Pipeline mode.

Authentication:

To configure authentication navigate to the site in IIS Manager and select the site in the left hand tree view. This will open the "Features View" in the middle panel.

Double click on the Authentication icon:

This will open up a list of the various authentication settings available to you:

From here you can right click on each Authentication setting and enable/disable as per your needs.

To enable Windows authentication for a page, you'd normally:

• Create a group in AD

• Populate that group with users

• In IIS Manager, open the directory you want to secure

• Edit the Authentication settings for that directory
• typically, they'd be:
  • enable Windows Authentication
  • disable Anonymous to avoid mucking around with file system permissions too much

At this point, file system permissions will be used to govern whether an authenticated user has access to the site or not. So you just need to check file system permissions are OK:

• Right-click and Explore the website in question
• Edit the Security settings on the file you want to be authenticated (if it's not the whole folder)
  • Ensure that anonymous users are removed from Read permission to the file
  • Ensure that your chosen group does have Read permission to the file
  • Ensure the App Pool Identity has Read access to everything

In your question, you talk about Integrated Windows authentication, but then describe enabling Basic authentication - that's not the same thing; from the client end (at least for IE), Basic always prompts for a username and password, and it transmits it unsecurely; Windows auth is more secure, and doesn't prompt for authentication (with caveats including dots in the URL, and Local Intranet Zone-ing).