The token that is returned varies from request to request, depending on which user is currently making a request to IIS. The first two security configurations result in a security token that represents a specific user from either the local machine’s security database or a domain. In IIS, the following directory security options are available:Īuthenticated access using Integrated Security (either NTLMor Kerberos-based), Basic Authentication, Digest AuthenticationĪuthenticated access using certificate mapping Depending on whether anonymous access or authenticated access has been configured for an application in IIS, IIS returns an authenticated user token or a default anonymous access token from the support function. If static content is being served (as opposed to an ASP.NET page or a resource mapped to the ASP.NET ISAPI extension), IIS6 internally handles all of the security processing for static content.Īny ISAPI extension has the ability to use the ECB to call a support function within IIS that returns the impersonation token for the current request. In the previous chapter, the difference between static and dynamic content handling was discussed. Will the ASP.NET site run from a remote file share (that is, a share defined with a Universal Naming Convention name)? This question is orthogonal to the previous two considerations because using a UNC share is primarily a deployment decision, but one that does has ramifications for security.įrom a technical perspective, IIS6 sets up security information for a request by initializing an Extension Control Block (ECB) structure and passing this structure to the ISAPI extension responsible for serving dynamic content. Will ASP.NET handle authentication using forms-based authentication, or some other custom authentication strategy? From an ASP.NET perspective, the security choices in IIS boil down to the following:ĭoes the ASP.NET application require a WindowsPrincipal for each user that authenticates with the website? Once configured, IIS6 performs the necessary work to set up security information for each request.

You can choose the specific security that should be enforced for an application or for a virtual directory. Official transcripts with Fall In Progress classes due to verify eligibilityĭeadline to Accept Admission Offer & Pay Enrollment Confirmation Depositįall 2022 applicants must complete all admission requirements no later than the end of the Spring 2022 term.In many ways, the security processing that occurs within IIS6 is something of a black box.

Spring 2022 Application and Admitted Student DeadlinesĪpplication Priority Deadline (Impacted Majors)

Spring 2022 applicants must complete all admission requirements no later than the end of the Fall 2021 term. Here are a few important dates and deadlines to keep in mind for admission:

Unc mac program application due date