How do I create a user account for basic authentic

Question

I'd like to add basic authentication to my website. I followed the instructions in the MSDN article on Configure Basic Authentication (IIS 7)

To use the UI

1. Open IIS Manager and navigate to the level you want to manage. For information about opening IIS Manager, see Open IIS Manager (IIS 7). For information about navigating to locations in the UI, see Navigation in IIS Manager (IIS 7).
2. In Features View, double-click Authentication.
3. On the Authentication page, select Basic Authentication.
4. In the Actions pane, click Enable to use Basic authentication with the default settings.
5. Optionally, in the Actions pane, click Edit to type the default domain and realm.
6. In the Edit Basic Authentication Settings dialog box, in the Default domain text box, type a default domain or leave it blank. Users who do not provide a domain when they log on to your site are authenticated against this domain.
7. In the Realm text box, type a realm or leave it blank. In general, you can use the same value for the realm name as you used for the default domain.
   • Important
     If you enter the default domain name in the Realm text box, your internal Microsoft Windows domain name may be exposed to external users during the user name and password challenge.
8. Click OK to close the Edit Basic Authentication Settings dialog box.

Here's what I've done so far:

Now I need to create a user account for the basic authentication.

Does anyone know how to create users in IIS Manager?

Answer 1

Just to add a note, since I can't comment without 50+ rep...

If you have FIPS enabled on the server, it doesn't allow you to create users. Because IIS v8 (and lower I would imagine) does not use FIPS encryption algorithms. It would be great if it supported it , because obviously a user account in windows is insecure compared to a virtual user mapped to an isolated folder. Too bad.

Answer 2

It looks to me like Windows 8 and IIS 7 no longer provides any UI to create a user name and password for basic authentication that is NOT a windows local user account. It is clearly a superior approach to create an IIS-only user/password authentication pair, but it is not clear and easy how it is done.

Command line tools exist for this purpose. Some people create a Windows account and then remove the Log on Locally User Privilege.