Authentication is identifying a user before actually deciding whether he can be given access to the requested resource(s). IIS provides various authentication schemes. Let us see each one of them in brief.

·         Anonymous – This type of authentication gives users access to all the public areas of the web application without asking for a user ID or password. This kind of authentication is used where performance is a key and security is not a criterion. We can use this kind of authentication where we do not want to authenticate clients to the individual basis. By default, the anonymous authentication is enabled and uses the IUSR_machinename user account. The password for the user account is controlled by IIS.

·         Integrated Windows Authentication – This type of authentication can be used either with NTLM or Kerberos V5 authentication. This authentication can only work with Internet Explorer 2.0 and later.

·         Initially for the first response from IIS, Internet Explorer will try to recognize the header (Negotiate). Upon understanding the negotiate header the browser (IE) returns the information for both NTLM and Kerberos. Upon receiving the request IIS will decide whether to use Kerberos or NTLM based on the Internet Explorer version and windows type. This type of authentication is best suited for the Intranet applications.

·         Basic Authentication – Basic authentication is based on the HTTP 1.0 specification. When we use this type of authentication, the browser prompts the user for a user name and password. Once the user name and password are provided it is transmitted across HTTP in the form of plain text. To enhance security we can use SSL on top of basic authentication at the expense of some performance. The advantage of using this type of authentication is the ability to track the individual users, unlike the anonymous authentication.

·         Digest Authentication – Digest Authentication tries to address the weakness of Basic Authentication (sending user ID and password in plain text). Here instead of exposing the user ID and password in plain text, it will be sent by applying a hash function or a digest algorithm. Initially for the first request IIS sends a challenge to the client to create a digest and send it to the server. The client then applies a digest algorithm (specified by the server) to the combined data. The client sends the resulting digest to the server as the response to the challenge. The server then decrypts it to compare both.