single web app for both external users and domain users

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

bitshift - 22 Jun 2007 16:12 GMT

Ive been asked to allow internal (domain authenticated) users to get in to
my asp.net web application, while everyone else should use the login form.
One way ive seen others doing this, is to configure the application in IIS
to use windows authentication, uncheck anonymous, so as to have the browser
pass in the User.Identity value.

Then, when when a visotor hits the site, I can check if we have a domain
user with the User.Identity, and automatically log them in using a common
login name that is setup in the database. If the user.Identity is empty,
then force them to login as usual.

Sound reasonable ?

Reply to this Message

bruce barker - 22 Jun 2007 16:32 GMT

its much tricker than this. if you turn off anonymous, no one can access
the site with a successful domain login.

for the browser to send credentials, the server must send a 401 (access
denied). the browser then send some credentials. the server will return
another 401 if invalid, so the user can try again.

if you turn on anonymous, then iis never sends a 401 and the browser
will never send the user credentials.

the easiest solution is if the users ipaddress is internal, send a 401,
if not redirect to forms login.

-- bruce (sqlwork.com)

> Ive been asked to allow internal (domain authenticated) users to get in to
> my asp.net web application, while everyone else should use the login form.
[quoted text clipped - 8 lines]
>
> Sound reasonable ?

Reply to this Message

Rate this thread:

single web app for both external users and domain users

Free Magazines