[This is preliminary documentation and subject to change]
Advanced Digest authentication is exactly the same as Digest authentication except for the way that user credentials are stored on the domain controller (DC). Advanced Digest is a security improvement over Digest because Advanced Digest not only sends users credentials across the network as an Understanding the MD5 Hash, Advanced Digest also stores user credentials in Active Directory on the DC as an Understanding the MD5 Hash, also known as a message digest. Because credentials are stored in Active Directory as an MD5 hash, user passwords cannot be feasibly discovered by someone with access to the DC. Advanced Digest authentication is available to Web Distributed Authoring and Versioning (WebDAV) directories and does not replace Digest authentication.
Installation of additional client software is not required; however, Advanced Digest authentication does rely on the HTTP 1.1 protocol as defined in the RFC 2617 specification at the World Wide Web Consortium Web site. Because Advanced Digest authentication relies on the HTTP 1.1 protocol, not all browsers support it. If a non-HTTP 1.1 compliant browser requests a file from a server using Digest authentication, the server will request the client to provide digest credentials. The non-HTTP 1.1. compliant client rejects the request because digest is not supported by the client.
Important
You can enable Advanced Digest authentication
only when the DC and IIS server are both running Windows Whistler.
If either your DC or IIS server is running Windows 2000 or earlier,
IIS defaults to Digest Authentication and does not warn you of this action.
Note
In Step 2, the IIS server reports to the client
(Internet Explorer) that Digest authentication is used, rather than
Advanced Digest authentication because the same Digest
authentication algorithm is used between the IIS server and the
client for both Digest and Advanced Digest authentication.
Important
If you follow the first two procedures
but do not configure the UseDigestSSP metabase key, you will be
using Digest authentication, not Advanced Digest
authentication.
| Metabase Level | Description |
| W3SVC | The W3SVC level, also known as the IISWebService level, is the highest level in the metabase where Advanced Digest can be configured. Configurations set at this level are inherited by lower levels that do not have specific configuration settings. |
| W3SVC/n | The W3SVC/n level, also known as the IISWebServer level, is a specific Web site, where n is the number of the site. Sites are numbered starting at 1. The default Web site is 1. |
| W3SVC/n/root | The W3SVC/n/Root level, known as the IISWebVirtualDir level, is the starting point for a Web Site, where n is the number of the site. |
| W3SVC/n/root/vdir | The W3SVC/n/ROOT/WebVirtualDir level, known as the IISWebVirtualDir level, is a virtual directory within a Web Site, where n is the number of the site. |
| W3SVC/n/root/vdir/webdir | The W3SVC/n/Root/WebVirtualDir/WebDir level, also known as the IISWebDirectory level, is a physical directory within a virtual directory within a Web Site, where n is the number of the site. |
| W3SVC/n/root/vdir/file | This is an individual file within the W3SVC/n/ROOT/WebVirtualDir level, where n is the number of the site. |
| W3SVC/n/root/vdir/webdir/file | This is an individual file within the W3SVC/n/Root/WebVirtualDir/WebDir level, where n is the number of the site. |
It is possible to configure either one or multiple realm names on an IIS server. If multiple realm names are used, they must be configured at different levels of the metabase. You may want to configure multiple realm names for instance, to allow access to the sales virtual directory to members of domain1 and access to the engineering virtual directory to members of domain2. This is particularly useful if domain1 and domain2 do not have a trust relationship. See the online Windows documentation for more information about domains.
If a child node in the metabase is not configured with a realm name, that child node inherits the realm name from the next higher level that has the realm name configured. If the realm name is not configured, IIS sends its own machine name as the realm name. If IIS sends its own name as the realm name and IIS is not running on a Windows XP domain controller with Active Directory, Advanced Digest authentication will fail. Although possible, it is not recommended to run IIS on a Domain Controller due to security risks and performance issues.
cscript.exe
c:\inetpub\adminscripts\adsutil.vbs set w3svc/1/realm
redmond.The command window displays:
realm
: <> "redmond".
Advanced Digest uses a metabase key called UseDigestSSP. This metabase key is a switch between Digest and Advanced Digest Security Support Provider Interface (SSPI) code. After the key has been set, the only valid property values are 1 (TRUE), 0 (FALSE), or empty. If the property is set to TRUE, the new SSPI code for Advanced Digest is used. In all other cases (FALSE, empty, or not set), IIS uses the Digest SSPI code.
You can configure the UseDigestSSP metabase property at any level of the metabase, shown in Table 2. If a child node is not specifically configured, it inherits its configuration from the next highest configured level.cscript /nologo
%SystemDrive%\inetpub\adminscripts\adsutil.vbs SET
level/UseDigestSSP True.For more information about the UseDigestSSP metabase key, see the UseDigestSSP in the Metabase Property Reference.
Use this example to test whether the UseDigestSSP metabase key has been configured at the w3svc/1 level.
cscript /nologo
%SystemDrive%\inetpub\adminscripts\adsutil.vbs GET
w3svc/1/UseDigestSSP.