Server access

[PW]

I have several ASP applications on my WinXP-Pro server. Typically I only
allow users to access my server on a demo basis. Once the system goes live
I remove their access and install the application on their own server.

I now have a situation where a company wants to subscribe to one of my
applications and I host it on an ongoing basis.

In the past I have given demo users "Basic" access to my server and created
a temporary user under the "manage" option, but now I want to give these new
subscribers only access to the directory where their application resides ...
and nowhere else.

How do I set this up ? The only options are ...

1. Anonymous
2. Basic
3. Integrated

 

[Roland Hall]

:
: I have several ASP applications on my WinXP-Pro server. Typically I only
: allow users to access my server on a demo basis. Once the system goes
live
: I remove their access and install the application on their own server.
:
: I now have a situation where a company wants to subscribe to one of my
: applications and I host it on an ongoing basis.
:
: In the past I have given demo users "Basic" access to my server and
created
: a temporary user under the "manage" option, but now I want to give these
new
: subscribers only access to the directory where their application resides
....
: and nowhere else.
:
: How do I set this up ? The only options are ...
:
: 1. Anonymous
: 2. Basic
: 3. Integrated

Anonymous - anybody in the world can access areas where this account has
authorization.
Basic - username and password required to access areas where this account
has authorization - authentication passed over the wire in plain text mode.
Integrated - username, password and domain required [if user not using
computer with domain account, user with domain account and same password] to
access areas where this account has authorization - authentication uses
token passed over the wire - user is sent an encrypted message that is
created by the server with user's username, password and domain. Only the
real user could decrypt the message and respond appropriately to the server
so the server knows this is an authenticated user. I repeat, credentials
are NOT passed over the wire.

Basic and Integrated work similar, in that the user is requested to provide
information. But, Integrated uses the information to decrypt message sent
by server and Basic sends the credentials in plain text to the server.
Integrated is better. Your users do not need to have an account in that
domain because when they try to connect, using Integrated, they will be
given a dialog requesting credentials. The difference to them would be that
the domain is also not required.

You set your security settings in IIS where you require authenticated access
using either a group or user account just for that user. You also set the
required rights at the file system level which must be NTFS.

HTH...

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp