> Dominick,
>
> Thanks for your response. I have one followup. If the JSP that is
> calling our web app is being authenticated and served up via an
> Apache/Tomcat web server will the .Net object structure (page.user)
> still be built up when the ASP page gets initiated??
>
> "Dominick Baier" wrote:
>
>> Hi,
>>
>> 1) yes - that still works - it has nothing to do where the request
>> comes from - it has to enter the asp.net app which means IIS does
>> authentication and hands the information to asp.net
>>
>> 2) you can handle the End_Request event (e.g. in global.asax - if the
>> status code is 401 - do the redirect..)
>>
>> ---
>> Dominick Baier, DevelopMentor
>> http://www.leastprivilege.com
>>> We are currently developing a corporate intranet app using ASP.Net
>>> 2.0 app and wish to use Windows Integrated Security. I have
>>> developed a small test app that excercises the capabilities of using
>>> Windows authentication and I have two questions.
>>>
>>> First, we have a requirement that our app be launched from a link on
>>> the corporate intranet site which is implemented using JSP. Will the
>>> page.user property still be populated with the credentials created
>>> and authenticated at the time the user logged into the network when
>>> called from a JSP page??
>>>
>>> Second, I have set up my test app with a default page and two other
>>> pages. The two secondary pages are in their own directory and I have
>>> secured those directories using the authorization tag in the
>>> web.config file (example below)
>>>
>>> <authorization>
>>> <deny users="?" />
>>> <allow roles="XXX\YYYYYY" />
>>> <deny users="*" />
>>> </authorization>
>>> When I try to access the secured page that I should not have access
>>> to, in the development environment I am simply presented with the
>>> default "access is denied" page. When I deploy the test app on IIS
>>> and
>>> access the secured page that I do not have access to I am presented
>>> with the Windows logon screen to supply a user id and password. If I
>>> supply a valid id and pw that does not have access to the AD group 3
>>> times I am then presented with the default "access is denied" page.
>>> Is
>>> there a way to suppress the login page and go directly to the
>>> "access
>>> is denied" page (trapping the failure and redirecting to another
>>> page
>>> is also acceptable)?
>>> Thanks in advance....
>>>