asp.net security: Windows authentication in code -- asp.net security

RE: Windows authentication in code

Jerry C
6/29/2006 6:27:01 AM

Joe and Luke,

Thank you for the reply. I am using Windows Auth for users that are using IE
and have a companion account or a domain account and that works OK. Other
users are on Macks or using IE not have Companion accounts on the server (No
domain) or using
some other browser that does not log them on. These users will get the
Windows Logon Popup. The customer does not like that popup and wants these
users to go to a different custom logon page that is set to anonymous and
enter a user and password. At this point I have a username and a password. I
do not know how to program a form auth or the cookie to reauthenticate on
each request. Some code examples would help. I donâ€™t have any experience on
how HTTP reauthenticates on each request or programming authentication or
cookies.

--
Jerry

[quoted text, click to view]

Re: Windows authentication in code

Joe Kaplan (MVP - ADSI)
6/29/2006 9:26:53 AM

I'd really suggest you read up on some of the MSDN samples on forms
authentication. There are plenty of walk throughs available, and it is
pretty easy to get working. ASP.NET does most of the work for you.

This forum will be more effective for you if you pose specific questions
about things that aren't working.

One thing that is worth knowing is that the ASP.NET pipeline executes for
each request. There are different events on the pipeline, such as
Authenticate and Authorize, that are executed as part of the pipeline each
time. The various authentication modules such as forms and windows handle
these events and handle security accordingly. There have also been some
really useful MSDN articles in the past explaining the ASP.NET pipeline and
illustrating how it works.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
[quoted text, click to view]

Re: Windows authentication in code

Jerry C
6/30/2006 7:10:01 AM

Thanks for the reply. Here is the code I am trying to get to work. It may
illustrate what I am trying to do. I have hard coded username domain password
and left out the â€œDeclare Functionâ€ for simplicity. The page is set to
anonymous user and I am trying to logon a user to the workgroup, or domain
and create an http context that will authenticate the user on all other pages
for this session just like integrated windows authentication. Integrated
windows authentication is great stuff but other browsers donâ€™t do it and the
customer does not like the default login popup and would like to duplicate
that functionality. I am also linking to another web site (sharepoint on the
same machine) and would like the user to be recognized by that site.

Dim temp2WindowsIdentity As WindowsIdentity
Dim token As IntPtr = IntPtr.Zero

LogonUserA(â€œJerryâ€, â€œCDâ€, â€œxxxxâ€, LOGON32_LOGON_INTERACTIVE,
LOGON32_PROVIDER_DEFAULT, token)

temp2WindowsIdentity = New WindowsIdentity(token, "NTLM",
WindowsAccountType.Normal, True)

HttpContext.Current.User = New WindowsPrincipal(temp2WindowsIdentity)

The question is is this the correct way to do this and are there other
considerations like how directory security is set in IIS6.0 and so on.
Just looking for some guidence on this issue.

Thank you.

--
Jerry

[quoted text, click to view]

Re: Windows authentication in code

Joe Kaplan (MVP - ADSI)
6/30/2006 9:54:20 AM

A couple of things:

I'd suggest checking out the solution MS provides for calling LogonUser in
MSDN under the WindowsImpersonationContext class documentation. That shows
how to properly duplicate the token handle and close it as well. Also, I
think I'd use the "network" or "network cleartext" logon method instead of
interactive as it will be faster.

You will probably want to make this logon routine part of a forms
authentication implementation. The problem you will have though is how to
recreate the token on subsequent page visits. You will either need to cache
the token itself or the user's plaintext credentials so you can regenerate
the token.

Also, I don't know how you'll get this to integrate with SharePoint. It
expects Windows authentication. I'm not aware of any good ways to support
forms authentication with SharePoint except for maybe with ADFS. I think
you might consider going to basic authentication with SSL to get maximum
compatibility across browsers.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
[quoted text, click to view]

Re: Windows authentication in code

Jerry C
6/30/2006 11:50:01 AM

Joe,

Thank you for the reply. I guess that replicating Windows authentication in
code is not possible.
--
Jerry

[quoted text, click to view]

Re: Windows authentication in code

Joe Kaplan (MVP - ADSI)
6/30/2006 2:05:56 PM

Well, it is and it isn't. With Windows auth, the browser actually
authenticates on each request. If you use a tool like IE HTTP Headers
(freeware), you'll actually see the authorization header being sent by the
browser on each request. With basic auth, the header is just the username
and password base64 encoded. With IWA, it is either an NTLM
challenge/response or a Kerberos ticket.

Forms auth does something similar in that it generates a cookie for the user
that is used to perform subsequent authentications.

If you aren't using Windows auth, the browser will not send authorization
headers, so you have to rely on a cookie.

The real problem with doing Windows auth in code on top of Forms auth is
that you need a way to generate the logon token in each round trip. I
already discussed two ways you can accomplish that, but neither is perfect.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the asp.net security group.