Internetworkers: http://www.ibiblio.org/internetworkers/

["Austin, Roger" <rda AT rti.org>]

 Could you restate the question with more information? There are a lot
of "ifs and buts" in the question. It isn't hard to limit access, but it
is a maintenance chore to deal with the stuff involved in a secure site.
SSL is a requirement for most any "real" secure site, but you may not be
asking for that kind of system.
 Is it an intranet or open to the internet? Is it a mixed environment
(Windows and Macs) or one platform? How secure do you want to make it? I
have found at times that all that was needed was to unlink the URL from
a page and make the "authorized people" bookmark a URL. This just means
that the general population can't see a live link, but people could get
to the page if they guessed the complete URL. This is for very low risk
sites only, for sites which you want authorized people to see, but the
Earth wouldn't stop turning if someone else saw it. (e.g., local
non-profit board activities, personal bookmarks, etc.)
 Steve is correct with NTLM and IE/Mac, it is problematic (much hair
loss with IE4.5/Mac on a project ...) I haven't had the stomach to get
back to test IE5/Mac yet for NTLM support.
 Roger (in RTP)


Steven Champeon wrote:
> 
> on Mon, May 07, 2001 at 01:08:11PM -0400, Paula Paul wrote:
> > > Or, if you want to use what the rest of the Internet has used
> > > since IIS
> > > was just a memory leak in Microsoft's eye, you could enable Basic auth
> > > in IIS. Here's a rundown of all the different authentication methods
> > > supported by IIS:
> >
> > If you do choose to go with Basic Authentication (one of the
> > authentication methods you can enable on the tab used to disable
> > annonymous access, as described in my earlier post), you may want to use
> > it in conjunction with SSL.  Basic Authentication means that the userid
> > and password will be sent as clear text (thus it's better to require
> > secure HTTP).
> 
> Technically, the user/pass combination is sent as a Base64-encoded string,
> not clear text, though Base64 isn't encryption (more like a fancy ROT-13)
> so your advice with respect to SSL is correct, if what you're protecting
> is really worth the hassle.
> 
> > Since Basic Authentication ties the authentication to a
> > domain account and password, you may want the password encrypted.
> > If you choose windows integrated authentication, the password will also
> > be tied to a domain account, but it will not be sent in clear text.
> 
> It will also not be usable in any browser that doesn't support NTLM
> authentication, namely, everything but Internet Explorer. I'm not sure
> if IE5/Mac even supports NTLM. I seem to recall problems with IE4.5,
> at any rate.
> 
> In summary, Basic auth is fine for most purposes, and can be
> supplemented by SSL. If you don't want to encrypt the entire session,
> and your audience uses browsers that understand Microsoft-proprietary
> authentication, and you want to bother setting up user accounts for
> all of your Web visitors, and you don't want to bother setting up a
> proprietary database to manage user accounts, you can use NTLM.