Anonymous Authentication

text zoom

Previous: Configuring Windows Authentication Basic Authentication :Next

With Anonymous authentication, the server does not request the client to send user credentials. It is a good choice when our site or service is publicly available and we do not need to know the identity of the caller. Additionally, there are typically no browser restrictions which stem from incompatibilities with supported authentication mechanisms. When a site is configured for Anonymous authentication, all users are allowed access. It is important to note that although we may have IIS configured for Anonymous authentication, we may be authenticating at the ASP.NET layer, which is not true Anonymous authentication. This section assumes that both IIS and the application do not require a login.
Consider Anonymous authentication when

. Do not need to know the name and/or password of the caller for either login or business logic components.

The information being protected is considered as "public."

But when user base is restricted to provide a login name and password then Anonymous authentication is not required. If we designing a site that is providing personalized content only, Anonymous authentication may be a good choice. When using Anonymous authentication, the application thread will run as either:

The built-in anonymous Internet account, IUSR_MACHINENAME.

The account configured in IIS for the anonymous user.

The IIS system account.

If application is using other resources, such as COM+ components, databases, message queues, or UNC file shares, you will need to enable the appropriate permissions for the anonymous user. If this is the case, consider the following options:

Set up a domain controller that includes all of our Web and application servers. Configure the anonymous user to run as a domain user with the appropriate permissions for resource access. This method will give us easier manageability because your account management is centralized.

If we are not running in a domain, then we can create a user with the same name and password on each of the Web and application servers. This is not recommended due to the complexities with duplicate account management.

Having an anonymous Web site and not using ASP.NET impersonation will give us the highest performing, but the least secure, application configuration. To implement Anonymous authentication, configure IIS for Anonymous authentication and configure the appropriate anonymous user account. Configure ASP.NET using the Web.config file to use no authentication.

< system.web>
<authentication mode =”None”/>
</system.web>