: -----Original Message-----
: From: Depp, Dennis M. [mailto:deppdm@ornl.gov]
: Subject: RE: Basic question
:
: The encryption used when sending authentication to an IIS server depends
: on how you have configured the IIS server. You have several choices.
: Windows Integrated Authentication utilized NTLM or NTLMv2 depending on
: the configuration of the IIS server and the domain controllers.
Since Windows 2000 Integrated Windows Authentication has incorporated both
NTLM/NTLM v2 authentication and Kerberos Authentication (WWW-Authenticate:
Negotiate is the authentication header for Kerberos)
: Not all browsers utilize Windows Integrated Authentication.
: (I think only IE on Windows will support this.)
Most modern browsers support the NTLM/NTLM v2 (Mozilla/Firefox, Opera, IE).
Only IE supports Kerberos authentication OOB.
: Basic authentication will send the password
: in plain text across the network. With Basic authentication if you want
: authentication and encryption, you need to install an SSL certificate
: and force you users to use https to access your site.
: On IIS 6.0 there is also Digest and .net authentication.
: I am not familiar with either of these.
Digest Authentication is an open standard (see RFC 2617 etc), and was
implemented in Windows 2000 / IIS 5.0. I'm not sure what you mean when you
refer to ".net Authentication" - I assume you mean Passport Authentication?
: The encryption method used does not matter if the machine is
: part of the same domain as the IIS server or not.
I assume you mean the "authentication method does not matter"? Well, I
suppose we need to use the caveat that Kerberos can not be used if the client
machine is unable to obtain an appropriate ticket from the KDC.
Cheers
Ken
---------------------------------------------------------------------------
---------------------------------------------------------------------------
