Configuring and Implementing Windows Authentication in IIS Express

When developing Silverlight or other web applications, IIS Express is commonly used as a lightweight server integrated with Visual Studio. However, configuring Windows Authentication can present challenges, such as failure to pass user identity, resulting in service calls returning null records. Based on best practices, this article systematically explains how to implement Windows Authentication through IIS Express configuration.

Core Configuration Methods

Enabling Windows Authentication primarily involves modifying IIS Express configuration files, notably applicationhost.config and the project's web.config. Below is a step-by-step guide:

1. Unlock the Windows Authentication Module

First, unlock the Windows Authentication module in applicationhost.config. This file is typically located in the \My Documents\IISExpress\config\ directory (for Visual Studio 2015 and later, the path may be $(solutionDir)\.vs\config\). Locate the following line in the file:

<add name="WindowsAuthenticationModule" lockItem="false" />

Ensure the lockItem attribute is set to false to allow configuration overrides at the project level.

2. Set Override Mode for Authentication Sections

In the <sectionGroup> portion of applicationhost.config, modify the overrideModeDefault attributes for windowsAuthentication and anonymousAuthentication:

<sectionGroup name="security">
    <sectionGroup name="system.webServer">
        <sectionGroup name="authentication">
            <section name="anonymousAuthentication" overrideModeDefault="Allow" />
            <section name="windowsAuthentication" overrideModeDefault="Allow" />
        </sectionGroup>
    </sectionGroup>
</sectionGroup>

This permits custom authentication settings in web.config, preventing errors when deploying to IIS servers.

3. Configure the Project web.config File

In the application's web.config file, add the following configuration to enable Windows Authentication and disable anonymous authentication:

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <security>
            <authentication>
                <anonymousAuthentication enabled="false" />
                <windowsAuthentication enabled="true" />
            </authentication>
        </security>
    </system.webServer>
</configuration>

This configuration ensures only Windows-authenticated users can access the application, resolving issues with null user records.

Alternative Approaches and Additional Notes

Beyond the above methods, Visual Studio 2010 SP1 and later versions offer a simplified UI configuration option. By right-clicking the web project, selecting "Use IIS Express...", and then setting Windows Authentication to Enabled and Anonymous Authentication to Disabled in the properties panel, this approach automatically adds site-specific configurations to applicationhost.config, avoiding manual file edits. However, it may not suit all scenarios.

It is important to note that directly enabling Windows Authentication in applicationhost.config (e.g., setting <windowsAuthentication enabled="true" />) is a global change affecting all IIS Express sites, which could pose unnecessary security risks. Therefore, using project-specific web.config configurations is recommended for greater flexibility and maintainability.

Common Issues and Solutions

If authentication still fails after configuration, verify that anonymous authentication is disabled in applicationhost.config:

<authentication>
    <anonymousAuthentication enabled="false" userName="" />
</authentication>

Additionally, ensure IIS Express is restarted to apply changes. For Visual Studio 2015 and later, note that applicationhost.config may be located in the .vs\config\ subfolder of the solution directory, and the <UseGlobalApplicationHostFile> option in the project file determines whether to use global or solution-specific configuration files.

With proper configuration, IIS Express can effectively support Windows Authentication, making it suitable for scenarios like Silverlight applications that require user identity information. Developers should choose appropriate methods based on project needs and test compatibility when deploying to production environments.