Anonymous to Windows authentication   

Hi
My previous thread was trying to ask how to go from windows authentication 
to locally authenticating a user after windows fails.

As another approach would it be possible to have IIS use Anonymous access, 
and use a filter to check the user credentials in a database to determine 
whether to do windows or local authentication. If it is windows 
authentication, get the filter to set www-authenticate header for NTLM.

Is this feasible or would IIS do nothing because integrated authentication 
is not turned on?
-- 
regards Dave

date: Wed, 7 Mar 2007 02:52:15 -0800   author:   dareag

Re: Anonymous to Windows authentication   

This is not feasible.

IIS will not allow an authentication scheme that is not enabled on a
resource.  Changing the www-authenticate headers will trick the client, but
will not change what the server allows.

Also, I should point out that there is no case ever where you should adjust
the www-authenticate headers that IIS itself adds.  These headers match
exactly what the configuration allows.  If you want to remove a header, you
should change the configuration.  And as above, if you add a header, you
will just trick the client into making a request that cannot be served.

There is a use case for adding www-authenticate headers, and would be when
you implement a totally new authentication scheme.  IIS provides the
SF_NOTIFY_ACCESS_DENIED notification expressly for this purpose.  Note that
any solution that involves doing this would also involve having code on the
client that recognizes the new authentication type and knowing what to do
with it.

Thank you,
-Wade A. Hilmo,
-Microsoft

"dareag"  wrote in message
news:940DE8E6-4E2F-4F9F-9EA8-9B0862CDEF59@microsoft.com...
> Hi
> My previous thread was trying to ask how to go from windows authentication
> to locally authenticating a user after windows fails.
>
> As another approach would it be possible to have IIS use Anonymous access,
> and use a filter to check the user credentials in a database to determine
> whether to do windows or local authentication. If it is windows
> authentication, get the filter to set www-authenticate header for NTLM.
>
> Is this feasible or would IIS do nothing because integrated authentication
> is not turned on?
> -- 
> regards Dave

date: Wed, 7 Mar 2007 09:01:43 -0800   author:   Wade A. Hilmo [MS]

Re: Anonymous to Windows authentication   

This is not feasible because how do you use a filter to check the user
credentials if the user has not authenticated with an authentication
protocol yet.

I am not aware of any authentication protocol which supports "fall-
back" to other authentication protocols. You will have to create one
and make it work with existing browser agents, if it works.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//



On Mar 7, 2:52 am, dareag  wrote:
> Hi
> My previous thread was trying to ask how to go from windows authentication
> to locally authenticating a user after windows fails.
>
> As another approach would it be possible to have IIS use Anonymous access,
> and use a filter to check the user credentials in a database to determine
> whether to do windows or local authentication. If it is windows
> authentication, get the filter to set www-authenticate header for NTLM.
>
> Is this feasible or would IIS do nothing because integrated authentication
> is not turned on?
> --
> regards Dave

date: 10 Mar 2007 16:41:51 -0800   author:   David Wang