Securing REST endpoint using custom database and Basic Auth?

Question

I need to provide Google Earth users access to my REST endpoints. Currently there is a database that has the users and pwds as well as there roles. Roles determine what data in the website they can see and could be used to tell me which endpoints they have access to. I'm currently using Windows security for authentication, but this means I have to make changes to my users when ever changes in the database occur. I want to use that database for authenticating the endpoints. Google Earth only supports Basic Auth.

I've gotten as far as extending IIS to invoke Basic authentication but authenticate against a non-asp.net sql database, however, I don't know how to apply what I have now to securing the endpoints.

Answer 1

When securing ArcGIS Server, you can either use IIS authentication, or database authentication (you would want DB).

Alternately, disable anonymous access to your REST endpoint and expose a proxy page which accepts username/password. Then use your proxy page to authenticate against the information found in the database, and from there make a request to the REST end point with a pre-set windows authentication information. For added security, you can do IP filtering to only allow internal access to your REST endpoint (the proxy page will still be able to access your REST endpoint).