3

In IIS7.x, does WebDAV only authenticate against Windows accounts?

Do I need to create local windows accounts for each WebDAV user?

Is there a way to use 'IIS Manager Users' instead?

Kev
  • 7,877
  • 18
  • 81
  • 108

2 Answers2

2

You can use Basic Authentication with WebDAV, but the WebDAV redirector will only use Basic authentication with SSL connections.

You use Windows authentication when you want clients to authenticate using the NTLM or Kerberos protocols, so the user needs an Active Directory account.

Basic authentication requires that users provide a valid user name and password to access conten, so in this case you use an local account. However, the disadvantage of Basic authentication is that it transmits unencrypted base64-encoded passwords across the network. You should use Basic authentication only when you know that the connection between the client and the server is secure. The connection should be established either over a dedicated line or by using Secure Sockets Layer (SSL) encryption and Transport Layer Security (TLS). For example, to use Basic authentication with Web Distributed Authoring and Versioning (WebDAV), you should configure SSL encryption.

Guido van Brakel
  • 942
  • 5
  • 10
  • So you still need a local windows account to be able to use Basic Authentication? – Kev Mar 06 '11 at 15:56
  • Yes, all the HTTP authentication methods, in IIS like Basic, Digest and Integrated are hardwired to Windows accounts. This means that you need a Windows user on your server for every account you want to authenticate. But there is an IIS module which supports also [Basic Authentication against Non-Windows Accounts](http://www.iis.net/community/default.aspx?tabid=34&g=6&i=1669).You then have the ability to do plain Basic Authentication agains account stored e.g. in a database this would be handy in a range of situations like web applications, (WCF) web services, REST services, etc – Guido van Brakel Mar 06 '11 at 16:20
  • Just to be 100% sure... Basic Authentication + TLS is totally safe? – Wilt Jan 29 '16 at 12:41
0

Here how you can do that with IIS Manager Users. It does not rely on Windows user accounts but instead rely on IIS Mamager user accounts. https://artisticcheese.wordpress.com/2017/02/24/iis-webdav-hosting-using-iis-manager-users-to-authentication/

Jeremy
  • 103
  • 3
Gregory Suvalian
  • 101
  • 2
  • 1
    Whilst this may theoretically answer the question, [it would be preferable](//meta.stackoverflow.com/q/8259) to include the essential parts of the answer here, and provide the link for reference. – Jenny D Feb 26 '17 at 07:49