User
Authentication
User Authentication involves identifying and validating who the user is. Depending on
how a user is authenticated, IIS will process the request under a specific NT account.
IIS Authentication Methods
IIS supports three different methods of User Authentication:
Anonymous
This method is the default authentication for any type of access to IIS prior to being
prompted to provide login information. In this case the anonymous account, typically
IUSR_computername, is used. Under IIS 4.0, if automatic password synchronization is turned
on, abbreviated security credentials are maintained after the login. If anonymous access
is denied either because the IIS resource being accessed is protected or anonymous access
is disabled, one of the following authentication methods will occur.
Basic Authentication
When this method is used, the web browser is sent an Unauthorized HTTP response causing
the user to be prompted to provide login information. This information is then included in
subsequent HTTP requests to the same server. Login information is sent by the browser in
clear text unless SSL is used. This information is used to perform an normal NT
login.
NTLM Challenge/Response
This method is only supported by Microsoft Internet Explorer browsers used within the
context of a trusted NT domain. In this case an abbreviated security credential is sent by
Internet Explorer to IIS and the user is not prompted to provide login information.
The important thing to note about these three methods is what determines who the user
is and how the user is logged on to NT.
If you need to access a network resource, such as a shared file system, from an ASP
script, a network login must occur on the server. Furthermore, the login must occur under
an account that has access permissions to the network resource. To ensure a network login,
you have three options:
Allow anonymous access, but make sure automatic password synchronization
is disabled under IIS 4.0.
Allow authenticated access using Basic Authentication, but make sure
NTLM Challenge/Response authentication is disabled.
Use the File Transfer CS Computer.Impersonate method to log on to the network.
The first two options can be accomplished by using the IIS Console Manager
to change the configuration of IIS. This may or may not be possible depending on whether
or not you have administrative access to the server.
To disable automatic password synchronization under IIS 4.0 follow these
steps:
Start the IIS Console Manager
Display the properties for your web site
Select the Directory Security tab
Select the Edit button for Anonymous Access and Authentication Control
Select the Edit button for the Account used for Anonymous Access
Uncheck the Automatic Password Synchronization box
To disable NTLM Challenge/Response under IIS 4.0 follow these steps:
Start the IIS Console Manager
Display the properties for your web site
Select the Directory Security tab
Select the Edit button for Anonymous Access and Authentication Control
Uncheck the Windows NT Challenge/Response box
If neither of the first two options are possible, you may need to consider
using the third option. Below is an example of how to log into the network using
File Transfer CS :
<%
' Initialize a Computer object
Set Computer = Server.CreateObject("File Transfer CS .Computer")
' Log on to the network
Computer.Impersonate "myacct","mypasswd"
' Access network drives
:
:
' Log out
Computer.EndImpersonate
%>
|
In the above example, anonymous access is provided since the account and
password are hardwired into the ASP script. The same account will always be used
regardless of the user of your application. This technique is useful if the anonymous
account does not have permissions to access the network resource, or it is not possible to
disable IIS 4.0 automatic password synchronization.
|
This method can be disabled by setting the following registry value: HKEY_LOCAL_MACHINE\SOFTWARE\Infomentum\File
Transfer CS \AllowImpersonation
= False |
If you want to authenticate each user, you will need to create an HTML
form to collect login credentials that can then be passed to Computer.Impersonate. And
while this technique suffers from the same security issues as Basic Authentication, it is
no less secure, and can be used even if NTLM Challenge/Response is enabled.
|
If you are having problems accessing a specific file or directory, the best
place to start is run the Windows NT Explorer on the server that the file or directory is
located. Navigate to the file or directory, and use the right mouse button menu to display
the property sheet.
If the file or directory you are trying to locate in on an NTFS file system,
the property sheet will have a Security tab. Select the Security tab and press the
Permissions button to view and modify the permissions for the file or directory.
