To enforce access control properly, make sure that client are properly authenticated before they send a query to the server. The easiest way to ensure that a client is authenticated is to put an access control on the form that issues a query. You can also put an access control list (ACL) on the .idq, .htx, or .htw file used in a query.
Depending upon the configuration of Internet Information Server, one or more authentication mechanisms can be used. These are:
If anonymous logon is allowed, it will be used by default as long as all files accessed by the client are permitted to be accessed by the anonymous logon account. Whenever an attempt is made to gain access to a document for which access is denied to the anonymous user, an authentication dialog will be presented (if some other authentication mechanism is available). The client can then provide authentication and thereby gain the rights to access files that would otherwise be denied.
Important If you turn off clients' access to some protected files by disabling authentication on a virtual directory (that is, by setting Anonymous only), you should disable authentication for the .htw file. Otherwise, clients can see the contents of the protected files in the hit-highlights returned after issuing a query.
Authentication of all clients accessing the server can be forced by disabling the anonymous account.
For an intranet consisting entirely of computers running Windows NT Workstation and Windows NT Server, Windows NT Challenge/Response authentication is the preferred authentication mechanism. With Windows NT Challenge/Response, the client’s password is not transmitted in clear text over the network. A user does not need to log on to access the query forms, because a single logon is maintained. Index Server uses the same credentials that Windows NT uses.