Search code examples
asp.netauthenticationiiswindows-authentication

In what scenarios should we enable IIS Authentication if we already have web authentication implemented in our website?


I am aware of ASP.NET Authentication using Identity. So, if my application already has Authentication enabled, why would I want to enable IIS authentication on top of that?

Also, if I have both enabled, will that require a user to type in his or her credentials twice (once for the application login and then for the IIS login)?


Solution

  • Both are different things altogether.

    ASP.NET Authentication using Identity in your web application is used for authentication & authorization of End-User in your application.

    IIS authentication is for security and access management for hosted application.

    If we explore a little further why this is needed. End-user just need to rights for viewing data & doing operations using User Interface Screen.

    IIS user(used for IIS autehntication) might need right for creating schema, modifying schema as in Continuous Integration (CI) when you deploy code, new schema is created or existing schema can be modified.

    Also in multi-tiered application, we can choose to run service(web services, web API, WCF etc) under end-user authentication if needed OR user with more rights is required.

    All decisions depends on your architecture, needs & security requirements. No choice is good for all architecture needs. We need to choose what suits our requirement best in given scenario and we design in such way application is further extensible/scalable for higher loads and easier for maintaining code too in long support.