Basic authentication is an HTTP standard. This authentication transmits a user name and password in each request. IIS maps the user name and password to an account on the Web server, producing an access token that can be used to perform ACL-based security checks. When IIS is configured for Basic authentication, it instructs the browser to send the user's credentials over HTTP. Passwords and user names are encoded using Base64 encoding. Although the password is encoded, it is considered insecure due its ability to be deciphered relatively easily. The browser prompts the user with a dialog box, and then reissues the original anonymous request with the supplied credentials, including the user name and password. A pop-up logon dialog box may or may not be appropriate, depending upon user interface design requirements. Most Internet browsers support Basic authentication.

Figure-Basic Authentication

Consider Basic authentication when:

• Users have Windows NT Domain or Active Directory accounts.
• It needs to support multiple browser types, including Netscape Navigator and all versions of Internet Explorer.
• It needs to support authentication over the Internet.
• It needs to access the clear text password in application code.
• It needs to support delegation.

Basic authentication not consider when:

• It requires a secure login and is not using a secure channel, such as that provided by Secure Sockets Layer (SSL).
• Users are stored in a custom database, and do not have Windows accounts.

We can delegate from one computer to another using Basic authentication. Delegation happens because the IIS server will log on the user locally via a call to the Win32 API LogonUser. Because IIS has the clear text password of the user, it can respond to challenges from remote computers, allowing the Web server to act on behalf of the client.

To implement Basic authentication, configure it within IIS and make sure that users have the "log on locally" privilege on the Web server. If application needs to run as the user authenticated by Basic authentication, use the following Web.config file configuration-

< system.web>
<authentication mode =”Windows”/>
</system.web>