Microsoft Sharepoint Products and Technologies Resource Kit eBook

376 Part V: Administration of Windows SharePoint Services
Authentication Methods
You configure authentication for websites based on Microsoft Windows SharePoint
Services by configuring authentication methods in Internet Information Services
(IIS). Windows SharePoint Services uses the authentication method you specify for
a virtual server in IIS to control authentication for all top-level websites and subsites
of that virtual server. Windows SharePoint Services works with the following authentication
methods in IIS:
■ Anonymous authentication. Anonymous authentication provides access to
users who do not have Microsoft Windows NT server accounts on the server
computer (for example, website visitors). IIS creates the anonymous account
for Web services, which is often named IUSR_computername. When IIS
receives an anonymous request, it impersonates the anonymous account.
You can enable or disable anonymous access in IIS for a particular virtual
server, and enable or disable anonymous access for a site on that virtual server,
by using HTML administration pages for IIS Administration pages. Anonymous
access must be enabled in IIS before you can enable it for a website on that
virtual server.
Once you have enabled anonymous access for the virtual server with the
HTML administration pages for IIS, you will need to actually enable this same
level of access for each individual website. To do so, from the website page
itself (a feature that is not available from Central Administration), click Site Settings,
click Go To Site Administration under the heading Administration, and
then click Manage Anonymous Access under the heading Users And Permissions.
Note that by default, anonymous users can access nothing and you will
need to choose either Entire Web Site or Lists And Libraries.
■ Basic authentication. Basic authentication is an authentication protocol
supported by most Web servers and browsers. Although Basic authentication
transmits user names and passwords in easily decoded clear text, it has some
advantages over more secure authentication methods in that it works through
a proxy server firewall and ensures that a website is accessible by almost any
Web browser. If you use Basic authentication in combination with Secure Sockets
Layer (SSL) security, you can help protect the user names and passwords,
making your user information more secure.
Note It is strongly recommended that you use SSL any time you use Basic
authentication to ensure a secure deployment.