I am starting to write an ASP.NET 2.0 web based application. For
authorization we'd like to use the existing userids and passwords in our
Active Directory. We cannot use Windows integrated security becauses users
will be accessing our application from the intra AND internet net AND we
don't want people to be allowed into our application just because they are
logged into windows. Even thought we are using AD userid/password we still
want users to authenticate every. We also have a very large AD forest where
people depending on their area log into 1 of 20+ domains.
I've read the articles at:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/PAG
HT000026.asp
and
http://channel9.msdn.com/wiki/default.aspx/SecurityWiki.HowToUseFormsAuthWithADI
nMultipleDomains
No matter what I do right now I always get a message back saying that the
user cannot be authenticaed.
Are there any other good reads on this, or has anybody done this before
useing asp.net 2.0?
Thank you,
Patrick Allmond
Would you consider using Basic authentication with SSL? It does not require
any additional code and will force the users to be challenged to
authenticate.
If your site is going to be secure, you really need to use forms auth with
SSL anyway to prevent users' forms auth tokens from being stolen anyway.
That would be the easiest way by far to handle authentications in a complex
forest as Windows will sort out all that stuff for you.
Joe K.
>I am starting to write an ASP.NET 2.0 web based application. For
> authorization we'd like to use the existing userids and passwords in our
[quoted text clipped - 22 lines]
> Thank you,
> Patrick Allmond
Patrick Allmond - 31 Oct 2005 17:14 GMT
Thanks Joe (I think you have helped me before).
Does ASP.NET 2.0 have some built in objects to manage what you are proposing?
P
> Would you consider using Basic authentication with SSL? It does not require
> any additional code and will force the users to be challenged to
[quoted text clipped - 34 lines]
> > Thank you,
> > Patrick Allmond
Joe Kaplan (MVP - ADSI) - 31 Oct 2005 19:37 GMT
You just enable Basic auth in IIS, disable anonymous, enable SSL and enable
Windows auth in ASP.NET. From there, it just works.
Context.User will contain a WindowsPrincipal object that represents the
authenticated user. The IsInRole method will answer true/false based on the
user's group membership.
It actually works exactly the same as IWA from a programming perspective.
Joe K.
> Thanks Joe (I think you have helped me before).
>
[quoted text clipped - 50 lines]
>> > Thank you,
>> > Patrick Allmond