windows authentication with forms -- asp.net security

dennisG
8/23/2005 3:01:46 AM

Hi,

I have a problem with windows authentication, with a web based form. I
can logon with the function logonuser with my username, password and
domain, but I don't get the windows rights of my windows account. I've
looked to different websites, but it doesn't solved my problem.

My code, function that works on the login button
Private Sub cmdLogin_Click(ByVal sender As System.Object, ByVal
e As System.EventArgs) Handles cmdLogin.Click
Dim username As String = txtUsername.Text
Dim password As String = txtPassword.Text
Dim domain As String = "Domainname"

If ValidateLogin(username, password, domain) = True Then
FormsAuthentication.RedirectFromLoginPage(username,
chkRemember.Checked)
Else
lblError.Visible = True
End If
End Sub

And validation function:
Private Function ValidateLogin( _
ByVal Username As String, _
ByVal Password As String, _
ByVal Domain As String) As Boolean

Try
Dim token1 As New IntPtr
Dim loggedOn As Boolean = LogonUser(Username, Domain,
Password, 2, 0, token1)
Dim token2 As New IntPtr
token2 = token1
Dim wi As WindowsIdentity
Dim wp As WindowsPrincipal
wi = New WindowsIdentity(token2)
wp = New WindowsPrincipal(wi)
HttpContext.Current.User = wp
Return True

Catch When Err.Number <> 0
Return False
End Try
End Function

What I'm doing wrong, what I'm missing?

Thanks,
Dennis

Joe Kaplan (MVP - ADSI)
8/23/2005 9:08:02 AM

If you want code to execute with the security context of the user, you also
need to impersonate them as well using WindowsImpersonationContext.

Also, remember that the forms auth login here works on the initial request,
but you'll need to find a way to call LogonUser on each subsequent request
as well, presumably by storing their plaintext credentials in an encrypted
cookie or session state or something so you can retrieve them again.

Joe K.

[quoted text, click to view]

asp.net security : windows authentication with forms