的作用是什么？在 IIS 版本中？
我想知道在web.config中设置
我相信在 IIS 5 中，它几乎没有影响，因为所有这些都是由 Web 服务器集成和控制的。
在 IIS 6 和 7 上，我相信我可以将 Web 服务器设置为匿名访问，然后每个托管的 Web 应用程序可以通过设置模式依次确定是否要使用 Windows 身份验证。也就是说，web.config控制这些IIS版本中的ASP.NET并覆盖服务器。
我正在寻找一份白皮书或某种类型的参考资料，以支持这一点，而不仅仅是我的观察经验
I am wondering what the effect of setting <authentication mode="windows"> in the web.config is in different version of IIS.
I believe that in IIS 5, it has little to no effect, as all of that is integrated and controlled by the web server.
On IIS 6 and 7, I believe that I can set the web server to Anonymous access and then each hosted web application could in turn determine if it wanted to use Windows Authentication by setting the mode. That is to say, the web.config controls ASP.NET in these IIS versions and overrides the server.
I am looking for a white paper or reference of some type that will back this up more than just my observational experience
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
据我所知，5 和 6 之间在安全性方面几乎没有变化。然而，IIS 7 是一次重大改进，与 IIS 6 有很大不同（但是，IIS 7 允许您在“兼容”模式下运行，这样您的应用程序的行为几乎与 IIS 5 和 6 下的行为完全相同）。
有几篇有用的文章可能会有所帮助：
To my knowledge, there were few changes between 5 and 6 in respect to security. However, IIS 7 was a major overhaul and differs from IIS 6 quite a bit (but, IIS 7 allows you to run in "compatibility" mode so that your applications would behave almost exactly the same way they did under IIS 5 and 6).
There are a couple of useful articles that might help:
IIS 5 也已过时（Windows XP 将于明年消亡）。尽管据我所知您的理解并不正确，但讨论有关它的更多细节没有什么价值。
该设置仅决定 ASP.NET 框架如何解释 IIS 传递的本机用户令牌（因为 IIS 使用其身份验证提供程序提前执行身份验证）。所以对于IIS 6/7/8，当你在ASP.NET端设置这个时，你需要仔细检查IIS端对应的设置是什么。
例如，当 IIS 端使用匿名/（集成）Windows/Basic/Digest 身份验证时，不同类型的用户令牌将传递到 ASP.NET。
http://msdn.microsoft.com/en- us/library/907hb5w9(v=vs.100).aspx
因此，您的理解
“我可以将 Web 服务器设置为匿名访问，然后每个托管的 Web 应用程序可以依次确定是否要通过设置模式使用 Windows 身份验证”是错误的。如果您打算使用 Windows 身份验证来对客户端进行身份验证，则必须在 IIS 端和 ASP.NET 端都进行设置。从 IIS 7 开始，IIS 管理器将这些设置放在同一位置，但您仍然需要充分了解它们的差异和关系。
有关 ASP.NET 身份验证的更多信息，可以参考 http://msdn.microsoft.com/en-us/library/eeyk640h(v=vs.100).aspx
IIS 5 is also obsolete (Windows XP will die next year). There is little value to discuss about the further details about it, though your understanding is not correct as far as I can remember.
That setting alone only determines how ASP.NET framework interprets the native user token passed on by IIS (as IIS performs authentication ahead using its authentication providers). So for IIS 6/7/8, when you set this on ASP.NET side, you need to carefully check what is the corresponding setting on IIS side.
For example, when IIS side uses anonymous/(Integrated) Windows/Basic/Digest authentication, different types of user token will be passed on to ASP.NET.
http://msdn.microsoft.com/en-us/library/907hb5w9(v=vs.100).aspx
Therefore, your understanding of
"I can set the web server to Anonymous access and then each hosted web application could in turn determine if it wanted to use Windows Authentication by setting the mode" is wrong. If your intention is to use Windows authentication to authenticate clients, you must set it on both IIS side and ASP.NET side. Starting from IIS 7, IIS Manager puts those settings in the same place, but you still need to fully understand their differences and relationships.
For more information on ASP.NET authentication, you can refer to http://msdn.microsoft.com/en-us/library/eeyk640h(v=vs.100).aspx