ISA 2006 – Pass-through authentication + basic authentication = HTTP 403

Hello,
when you try to configure ISA 2006 to publish a website, letting the website itself handle the authentication (i.e. basic authentication), you might get an immediate 403 error.
To achieve what stated above you would usually configure the rule as follows:
Authentication on ISA: no authentication
Authentication delegation: no delegation but client can authenticate
MS tells you that if you get a straight 403 it might mean that:
1. you did not select “allow HTTP authentication” in the advanced settings
2. you did not configure a HTTPS port
They forgot 1 more possibility:
In the users tab you might have “All authenticated users” which is not possible since you are not authenticating on ISA anymore (but that’s the default setting of every website publishing rule).
Put “All users” instead and everything should work fine.

HTH,
Roberto.