Don't use a form, just use Windows Authentication on the application/site.

You can't take a plain text password from a form, and "check" it against
Windows Authentication, AFAIK. This would be a *H*U*G*E* security hole.

--
Aaron Bertrand
SQL Server MVP
http://www.aspfaq.com/




[quoted text, click to view]

Dear All

Newbie question here. i design form to take input from
user(username,password). How do i autheticate if the user is Windows Domain
user and once it has authenticated successfully, how do i forward to the
success page.

Any help would be appreciated.

Regards

Zille.

[quoted text, click to view]

I hope that even through ADSI this is impossible. A programmer should never
be able to have access to Windows passwords, for reasons that should be
obvious.

--
Aaron Bertrand
SQL Server MVP
http://www.aspfaq.com/

But how do i do it, i am really new to ASP. do i have to enable Windows
authentication from the IIS admin.

and how do i store the username and password taken from the user in session
variables

[quoted text, click to view]

You could use ADSI to do it...

Cheers
Ken


[quoted text, click to view]
: Don't use a form, just use Windows Authentication on the application/site.
:
: You can't take a plain text password from a form, and "check" it against
: Windows Authentication, AFAIK. This would be a *H*U*G*E* security hole.
:
: --
: Aaron Bertrand
: SQL Server MVP
: http://www.aspfaq.com/
:
:
:
:
[quoted text, click to view]
: > Dear All
: >
: > Newbie question here. i design form to take input from
: > user(username,password). How do i autheticate if the user is Windows
: Domain
: > user and once it has authenticated successfully, how do i forward to the
: > success page.
: >
: > Any help would be appreciated.
: >
: > Regards
: >
: > Zille.
: >
: >
:
:

On Mon, 1 Dec 2003 08:38:18 +0300, "Zille Hassan" <zhassan@umg.com.sa>
[quoted text, click to view]

Take a look at:

http://www.iisfaq.com/default.aspx?View=P78&P=145

[quoted text, click to view]

Don't ever store the password in a session variable. You could set a
session variable for "Logged In" but with Windows authentication
there's no real reason to (at least that my feeble little mind can
come up with at the moment...). Windows knows whether you're logged
in or not.

Jeff

[quoted text, click to view]