History

The first Microsoft webserver was a research project by the European Microsoft Windows NT Academic Centre (EMWAC), part of the University of Edinburgh in Scotland, and was distributed as freeware.[2] However since the EMWAC server was unable to scale sufficiently to handle the volume of traffic going to microsoft.com, Microsoft was forced to develop its own webserver, IIS.[3]
IIS was initially released as an additional set of Internet based services for Windows NT 3.51. IIS 2.0 followed, adding support for the Windows NT 4.0 operating system; and IIS 3.0 introduced the Active Server Pages dynamic scripting environment.[4]
IIS 4.0 dropped support for the Gopher protocol and was bundled with Windows NT as a separate "Option Pack".[citation needed]
The current shipping version of IIS is 7.5 for Windows 7 and Windows Server 2008 R2, 7.0 for Windows Vista and Windows Server 2008, 6.0 for Windows Server 2003 and Windows XP Professional x64 Edition, and IIS 5.1 for Windows XP Professional. Windows XP has a restricted version of IIS 5.1 that supports only 10 simultaneous connections and a single web site.[5] IIS 6.0 added support for IPv6. A FastCGI module is also available for IIS5.1, IIS6[6] and IIS7.[7]
IIS 7.0 is not installed by Windows Vista by default but it can be selected from the list of optional components. It is available in all editions of Windows Vista including Home Basic. IIS 7 on Vista does not limit the number of allowed connections as IIS on XP did but limits concurrent requests to 10 (Windows Vista Ultimate, Business, and Enterprise Editions) or 3 (Vista Home Premium). Additional requests are queued which hampers performance but they are not rejected as with XP.
IIS 7.0 (Windows Vista/2008) is much faster than IIS 5.1 (Windows XP) because it relies on the HTTP.SYS kernel driver.

Versions

• IIS 1.0, Windows NT 3.51 available as a free add-on
• IIS 2.0, Windows NT 4.0
• IIS 3.0, Windows NT 4.0 Service Pack 3
• IIS 4.0, Windows NT 4.0 Option Pack
• IIS 5.0, Windows 2000
• IIS 5.1, Windows XP Professional, Windows XP Media Center Edition
• IIS 6.0, Windows Server 2003 and Windows XP Professional x64 Edition
• IIS 7.0, Windows Server 2008 and Windows Vista (Business, Enterprise, Ultimate Editions)
• IIS 7.5, Windows Server 2008 R2 and Windows 7

IIS 6.0 Authentication Model

An important part of many distributed applications is the ability to identify someone, known as a principal or client, and to control the client's access to resources. Authentication is the act of validating a client's identity. Generally, clients must present some form of evidence, known as credentials, proving who they are for authentication. Typically, credentials include a username/password pair.
SharePoint Portal 2003 is built upon IIS 6.0. Lets first take a look at the authentication model of IIS.
IIS provides a variety of authentication schemes:

Anonymous (enabled by default):

Anonymous authentication allows a user to access web and FTP sites without having to provide a username and password. When a client user accesses a web or FTP site, IIS uses the Internet Guest Account to authenticate that user.
The Internet Guest Account is created when IIS is installed, and it is named IUSR_, where is the name of the host machine. Having an account to use for anonymous access allows you to configure which resources all anonymous users can access on your server. The anonymous account is also added to the Guests group when IIS is installed, so any restrictions or permissions applied to that group also apply to the account.

Basic Authentication:

When a server uses Basic Authentication, the Web browser (or the FrontPage client) prompts the user for a name and password. The user name and password are then transmitted across HTTP, in clear text. Using this user name and password, IIS authenticates the corresponding Windows NT user. To use Basic authentication, a user account must be defined on either the local machine or on a trusted domain controller. The account-based access control is all done through the NT File System (NTFS) permissions on the file system.

Integrated Windows authentication:

Integrated Windows authentication is the most secure method of authentication, but it is available only with Internet Explorer. In Integrated Windows authentication, the user's browser proves itself to the server using a cryptographic exchange during the authentication process.

Integrated Windows authentication supports both the Kerberos v5 and the NTLM (NT LAN Manager) protocols for authentication through the Negotiate package.

Digest Authentication:

Like Basic Authentication, Digest Access Authentication is based on a simple challenge-response method. The Digest scheme challenges using a nonce value (a server-specified data string which may be uniquely generated each time a 401 error is made.). A valid response contains a checksum of the user name, the password, the given nonce value, the HTTP method, and the requested URL. In this way, the password is never sent as easily decoded text, which is Basic Authentication's biggest weakness.

.NET Passport Authentication:

IIS 6 can use Microsoft's .NET Passport to authenticate users requesting resources from a web site or a web site virtual directory. The benefit that this solution offers is that the credentials are stored and managed on another server that you are not responsible for building or maintaining. Users can authenticate using the .NET Passport service and then be allowed access to the web site hosted on your WS03 server.

IIS

Internet Information Services (IIS) - formerly called Internet Information Server - is a set of Internet-based services for servers created by Microsoft for use with Microsoft Windows. It is the world's second most popular web server in terms of overall websites behind the industry leader Apache HTTP Server. As of April 2009[update] it served 29.27% of all websites according to Netcraft.[1] The services provided currently include FTP, FTPS, SMTP, NNTP, and HTTP/HTTPS.

Wikipedia : http://en.wikipedia.org/wiki/Internet_Information_Services