IIS and EFS

20 Jul 2005 5:46 PM

Ageen

Hi,

We are planning to use either IIS 5.0 or 6.0 for some
internal use. All of our users must go through a
single sign on authentication first before they can
use any one of the available services. I was wondering
if we use EFS to encrypt the IIS root folder, when the
end users coming to our site are they required by EFS
to be authenticated? Based on a KB article, Q243756,
that I read today it sounds like the user will be
required to be authenticated first. If thatâ€™s the case
is there any way that we can let the users coming to
our site without being authenticated first, in the
meantime being able to use EFS? Thanks

FH

21 Jul 2005 7:12 AM

Bernard Cheah [MVP]

Don't think is possible as my understand is that - becaues those files are
encrypted with user private keys. Hence, you need to authenticate first, or
else IIS won't know which user's private key to use to retrieve the file.

--
Regards,
Bernard Cheah
http://www.microsoft.com/iis/
http://www.iiswebcastseries.com/
http://www.msmvps.com/bernard/

Show quoteHide quote

"Ageen" <Ag***@discussions.microsoft.com> wrote in message
news:CF3589D4-62BB-495F-AEBB-D857988D3857@microsoft.com...
> Hi,
>
> We are planning to use either IIS 5.0 or 6.0 for some
> internal use. All of our users must go through a
> single sign on authentication first before they can
> use any one of the available services. I was wondering
> if we use EFS to encrypt the IIS root folder, when the
> end users coming to our site are they required by EFS
> to be authenticated? Based on a KB article, Q243756,
> that I read today it sounds like the user will be
> required to be authenticated first. If that’s the case
> is there any way that we can let the users coming to
> our site without being authenticated first, in the
> meantime being able to use EFS? Thanks
>
> FH
>
>
>

21 Jul 2005 5:30 PM

Miha Pihler [MVP]

Hi,

That is true. It won't work (at least not easily). Private keys of the
user's would have to be on IIS server in user's profiles (yes, users would
have to have profiles on IIS server for storing private keys) and the server
would have to be Trusted for Kerberos Delegation etc...

--
Mike
Microsoft MVP - Windows Security

Show quoteHide quote

"Bernard Cheah [MVP]" <qbern***@hotmail.com.discuss> wrote in message
news:%23eAIhOcjFHA.2852@TK2MSFTNGP15.phx.gbl...
> Don't think is possible as my understand is that - becaues those files are
> encrypted with user private keys. Hence, you need to authenticate first,
> or else IIS won't know which user's private key to use to retrieve the
> file.
>
> --
> Regards,
> Bernard Cheah
> http://www.microsoft.com/iis/
> http://www.iiswebcastseries.com/
> http://www.msmvps.com/bernard/
>
>
> "Ageen" <Ag***@discussions.microsoft.com> wrote in message
> news:CF3589D4-62BB-495F-AEBB-D857988D3857@microsoft.com...
>> Hi,
>>
>> We are planning to use either IIS 5.0 or 6.0 for some
>> internal use. All of our users must go through a
>> single sign on authentication first before they can
>> use any one of the available services. I was wondering
>> if we use EFS to encrypt the IIS root folder, when the
>> end users coming to our site are they required by EFS
>> to be authenticated? Based on a KB article, Q243756,
>> that I read today it sounds like the user will be
>> required to be authenticated first. If that’s the case
>> is there any way that we can let the users coming to
>> our site without being authenticated first, in the
>> meantime being able to use EFS? Thanks
>>
>> FH
>>
>>
>>
>
>