IIS Anonymous user authentication doesn't work with AD credentials

Question

I have an asp.net application directory, and I want to use anonymous authentication in the Directory Sercurity tab.

If I use the pre-Windows 2000 style DOMAIN\USERNAME for the username, everything is fine.

If I use the AD-style (UPN) [email protected], then I get a 401.1 failed login.

I've tried a number of variations, but can't get it to work. If I select the user from the Browse box, the AD name comes up in the box, but the pre-Windows 2000 name is filled-in. Likewise for SQL Server 2005.

It seems that the UPN isn't 'real', is this right? Given that it's not required and doesn't have to be unique; it seems very odd.

Am I correct, in that this is not supported? Would IIS 7 make any difference?

I wish to do this, because the limit of 20 characters for the pre-Windows 2000 username is insufficient for the role-based security I wish to apply for different webservices (the application directories) coming off this website.

Answer 1

Update 1: I have tried it on Windows 2003 sp 2. In the login "directory security" I have checked the enable anonymous access check box ( and only this box ) and put [email protected] and the ausername password. The site is plain asp.net without sql backend.

Are you able to login to the server with the [email protected] ? Can you test this on different domain? It may be some wired dns resolution problem.

Update 0:

I tested it on iis 6 and the [email protected] combination works fine on my machine.

About the "realnes" of the names. No name is "real" the actual account is just a GUID. The names are just for convenience.

Answer 2

Are you sure it's domain.local and not domain.com. If the domain\username is working, then [email protected] should work.

Answer 3

UPN suffixes should work, althouh there is a bug which occurs when there is a service pack difference between the IIS box and the domain controller. There is a patch for it. This link discusses the issue in detail.