> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superoffice.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Basic Authentication in IIS

> Web API authentication anon

## IIS Configuration

Configure the SuperOffice IIS website for Anonymous access.

![iis-config-site -screenshot][img1]

Open the IIS Authentication dialog.

Disable all except **Anonymous** authentication.

![iis-authentication-anonymous -screenshot][img2]

This sets up the site so that anyone can access the application and the WebAPI, but they will still need a valid SuperOffice username and password to access the site.

If you enable **Basic authentication** on the IIS site, then IIS will try to use any username+password passed in, and fail the call if the username and password are not valid Active Directory accounts (because that's where IIS checks its usernames and passwords).

The SuperOffice WebAPI can check usernames and passwords against the SuperOffice users without Basic authentication being enabled on IIS. We need to enable it for SuperOffice in *web.config*.

## SuperOffice web.config

You must explicitly [enable the authentication methods][2] you want to use in the *web.config* file.

```XML theme={null}
<WebApi>
  <add key="AuthorizeWithUsername" value="true" />
</WebApi>
```

**AuthorizeWithUsername** must be `true` otherwise the **Basic** authentication method will not work.

## Testing Login

Accessing the SuperOffice web page, you should see the login page, asking for a username and password.

![login-page -screenshot][img3]

## Testing WebApi

If we access the `/api/`endpoint, we should get a page describing the WebAPI

![api-page -screenshot][img4]

This page should require any login to access.

## Testing authentication

If we try to get some information out of the API, we should be asked to log in.

`GET /SuperOffice/api/v1/contact/2` should prompt for a username and password.

If we try to use the browser, we will get an error message: **401 Unauthorized**

![api-error -screenshot][img5]

If we use [Postman][1], we can add the Authorization HTTP header to the request.

![api-postman-basic -screenshot][img6]

This adds the `Authorization` header to the request, with the username:password base64 encoded:

![api-postman-header -screenshot][img7]

```http theme={null}
GET /SuperOffice/api/v1/Contact/2
Authorization: Basic YWRtMDo=
Accept: application/json
```

This returns the contact info

```json theme={null}
{
  "TableRight": {
    "Mask": "RI, RestrictedUpdate",
    "Reason": "[SR_ACCESS_ASSOCCONT_DELETE]"
  },
  "FieldProperties": { ... },
  "ContactId": 2,
  "Name": "statezerodatabase",
  "Department": "",
  "OrgNr": "",
  "Number1": "",
  "Number2": "",
  "UpdatedDate": "2016-01-04T13:27:28",
  "CreatedDate": "2002-07-23T15:14:29",
  "Emails": [],
```

[1]: https://www.getpostman.com/

[2]: ../../web-config/webapi

[img1]: /media/loc/en/onsite/iis-config-site.png

[img2]: /media/loc/en/onsite/iis-authentication-anonymous.png

[img3]: /media/loc/en/onsite/login-page.png

[img4]: /media/loc/en/onsite/api-page.png

[img5]: /media/loc/en/onsite/api-error.png

[img6]: /media/loc/en/onsite/api-postman-basic.png

[img7]: /media/loc/en/onsite/api-postman-header.png


## Related topics

- [Configure SuperOffice REST WebAPI](/en/onsite/install/netserver/setup-rest.md)
- [Configure WebTools](/integrations/webtools/config.md)
- [Integrated with Active Directory](/en/onsite/install/netserver/enable-iis-identity.md)
- [Technical overview](/integrations/webtools/technical-overview.md)
- [SuperOffice WebApi](/en/api/web-services/webapi/index.md)
- [Web services](/en/api/web-services/index.md)