>>You can only get the user name if you are running basic authentication. If challenge/response is turned on (even if basic is also), IIS will not report the user name. Only solution I know of here is getting client to turn off challenge/response.
>
>We tried with the basic authentication but with challenge response on. We'll turn if off tomorrow and see how it goes. Maybe the reverse proxy is not a factor. Any impact of having challenge response off?

I'm not sure about the reverse proxy at all, but I bet that won't affect it.

Having c/r off means passwords pass across the 'net unencrypted. Possible exposure to network sniffers. One alternative, other than ignoring this, is to use separate user ID's and accounts in the web server (plus a firewall) so that if IDs are stolen, at least they cannot use the same ones on the internal network.

-- Randy
(Wow that's an ugly picture. I wish you had taken mine at Devcon. Serves me right for trying to use my new camera on myself. <g>.)