Windows Authentication - Recommended
The following procedures are for deploying Windows authentication. You must have Windows authentication checked in the Server roles established during the Configure IIS step.
There are two main steps to enable Windows Authentication. The first step occurs in your Internet Information Services (IIS) Manager. The second steps occurs in the Web.config.
-
If you are using Windows/AD Authentication, the Logoff, Registered Users, and Register New User buttons are not available in the Wavepoint application.
-
If you are using Forms Authentication, those buttons are available in the Wavepoint application.
Enable Windows Authentication in IIS
- Open IIS Manager. The easiest way is to search for IIS in the Start menu on the server machine.
- In the Connections pane on the left-hand side, expand the connections until you see the Wavepoint site.
-
Click the Wavepoint site once to highlight it, then double-click
the Authentication icon.
-
Ensure the following options are enabled or disabled:
-
Anonymous Authentication: Disabled
-
ASP.NET Impersonation: Disabled
-
Basic Authentication: Disabled
-
Forms Authentication: Disabled
-
Windows Authentication: Enabled
-
Enable Windows Authentication in the Web.config
If necessary, navigate to C:\inetpub\wwwroot\Wavepoint and open Web.config in a text editor (Notepad++ or XMLSpy).
By configuring authentication using IIS Manager, some of the changes below might already be accomplished. Add the entries below only if absent from the Web.config.
-
In the <appSettings/> section of the Web.config file, add the following two lines:
<add key="autoFormsAuthentication" value="false" /> <add key="enableSimpleMembership" value="false" />
-
Then, set the authentication mode as Windows.
<authentication mode="Windows" /> <identity impersonate="true" />
-
Further, you can use the authorization section to specify the Active Directory groups that can (or cannot) access Wavepoint . See the Microsoft IIS documentation for more information about this configuration.
The default strings shown below will allow any valid user from any Active Directory group.
<authorization> <allow users="*" /> <deny users="?" /> </authorization>