3

I have some IHttpHandler implementations where they may optionally have authentication applied to them.

I originally rolled my own Basic authentication but would now like to use IIS's capabilities so that the deploying user can control what type of authentication they use and the handlers just look up whether the current user is allowed to perform the actions they request.

Determining whether a user can perform an action and returning a 401/403 is easy enough but what I can't figure out is how to get IIS to add in the relevant HTTP Headers to the response that request the client to send back credentials. I can add them manually but then I can only realistically implement Basic authentication (which is what I did originally) and this takes me back to square one.

Is there some magic method I can call that tells the HttpContext to append the relevant headers to the response?

And more generally is what I am trying to do even possible without resorting to implementing a IHttpModule to interfere in the authentication events of the ASP.Net page lifecycle?

RobV
  • 28,022
  • 11
  • 77
  • 119
  • have you tried sending auth headers 401 Unauthorized WWW-Authenticate: NTLM – shaans Mar 19 '11 at 16:21
  • @shaans Sending 401 Headers is easy if I only want to do Basic authentication but if I want to support arbitrary authentication schemes I really need to somehow get IIS to do this for me – RobV Mar 20 '11 at 14:43

0 Answers0