Selecting a Web Site Authentication Method

Applies To: Windows Server 2003, Windows Server 2003 with SP1

The authentication method that you select varies based on the level of protection it provides for user credentials (user account and password information), and on the relationship of the user to your organization. Select the strongest authentication method possible to help ensure that the credentials of your users are protected.

Web site authentication methods can be divided into two categories:

• Methods that do not require or encrypt user credentials

• Methods that encrypt user credentials

For Internet-based Web sites and applications, the most commonly used authentication methods do not require or encrypt user credentials. Select one of these authentication methods when any combination of the following is true:

• Access to the Web sites and applications needs to be anonymous.

• Access to the Web sites and applications needs to be independent of the client configuration and relationship of the user to your organization.

Anonymous access requires no authentication whatsoever. Anonymous access is used for intranet and Internet Web sites when you want unauthenticated users to be able to access the information provided by the Web sites and applications. The majority of Internet Web sites use anonymous access.

Use Basic authentication when you want to require authentication to access a Web site or application, but need to use an authentication method that provides any combination of the following:

• No special configuration is required on the client. For example, the client can run any operating system or Web browser.

• The users have no close affiliation with your organization, and they are typically not employees or employees of partner organizations. As a result, you cannot require them to use an authentication method that encrypts user credentials.

• Your network infrastructure does not support encrypted authentication methods. For example, to use Windows Integrated authentication, you need the connection between requests to be maintained. Most proxy servers do not support such keep-alive connections.

Because Basic authentication does not encrypt user credentials, use a Secure Sockets Layer (SSL)-secured channel to encrypt user credentials. If you cannot encrypt Basic authentication traffic by using a SSL-secured channel, use one of the authentication methods that encrypt user credentials. These authentication methods are described in Table 3.9.

Authentication methods that encrypt user credentials typically require some level of control over the client computer, and the user is usually an employee of your organization or a partner organization. Table 3.9 provides a comparison of the Web site authentication methods for Web sites and applications that encrypt user credentials.