IIS Username & Pass. Authentication Type?

[eldiablopotato]

Long story short I'm needing to add somekind of a username & password prompt to a Windows 2008 IIS7 server. To be honest IIS isn't my cup of tea, especially when it comes to picking the authentication type. There are so many choices: basic authentication, digest authentication, windows authentication, form authentication, and so on. If anyone can provide any guidance on which on to use, please post. 🙂

FYI, the server is alone.. meaning it has doesn't have access to active directory or a database.

 

[RebateMonger]

This article discusses each type of IIS authentication and gives pros/cons for each:

http://msdn.microsoft.com/en-us/library/aa292114(VS.71).aspx

Forms-based authentication is done when you have your own user account database and want to use it instead of any built-in Windows methods. If you have 1 million users and don't want 1 million Windows user accounts and don't want to hand out user certificates to 1 million people, then you'll probably do some sort of forms-based authentication.

If you use forms-based and don't want your authentications in clear text, you should use encryption of some sort (usually SSL).

 

[eldiablopotato]

This article discusses each type of IIS authentication and gives pros/cons for each:

http://msdn.microsoft.com/en-us/library/aa292114(VS.71).aspx

Forms-based authentication is done when you have your own user account database and want to use it instead of any built-in Windows methods. If you have 1 million users and don't want 1 million Windows user accounts and don't want to hand out user certificates to 1 million people, then you'll probably do some sort of forms-based authentication.

If you use forms-based and don't want your authentications in clear text, you should use encryption of some sort (usually SSL).

Thanks for the link, I forgot to mention that the IIS server is currently using SSL. There will only be at max 5 users accounts, so Basic auth with SSL might be the best way to go.. yes?

Originally I was thinking Windows auth, but since I don't have a kerberos server for it to talk to.