IIS 7: Disable authentication for certain client IPs

I have a virtual directory that's protected with basic authentication. I'd like to disable authentication for certain IPs, so that all requests from e.g. 127.0.0.1 are allowed without asking for credentials. How can I do this?

I was unable to find a built-in way to make this happen. I ended up writing an IIS module using the instructions by Microsoft.

The module checks the client's IP address (using HttpRequest.UserHostAddress), and if it is not on the exempt list, re-implements the standard basic authentication for Windows accounts (using the LogonUser API and setting HttpContext.User to a WindowsPrincipal). The authentication domain and list of exempt IP addresses are read from web.config (using ConfigurationManager.AppSettings).

Stumbling blocks included:

• I wanted to exempt the server itself, so I added 127.0.0.1 and the server's IP address to the exempt list, but also had to add ::1 (IPv6 localhost).
• I'm using this to protect access to hgweb, and for some reason I had to change the entries in hgrc's allow_push line from username to DOMAIN\username after enabling the plugin.