Groups | Blog | Home
all groups > iis security > february 2004 >

iis security : Pass username and password instead of userprompt



Magnus Jardeby
2/5/2004 1:01:42 PM
I have a problem with basic authentication.
I redirect a user from a page to another.
I don't want to get the NT prompt login, I want the user to be logged in
automatically.
I want to send the username/password to the page.

I have read something about cookies and sending username/password through
the header.

With the new Windows Update 832894 it is no longer possible to use
http(s)://username:password@server/resource.ext

Is there any other way to redirect to another page and pass the username and
password?

Thanks in advance!

/Magnus

David Wang [Msft]
2/6/2004 1:40:52 AM
Not that I'm aware of.

If you can induce the client to send a base64 encoding of username:password
as the "Authentication:" request header, it would accomplish the exact same
thing as what 832894 disallowed.

You should probably rethink your custom authentication scheme.

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
I have a problem with basic authentication.
I redirect a user from a page to another.
I don't want to get the NT prompt login, I want the user to be logged in
automatically.
I want to send the username/password to the page.

I have read something about cookies and sending username/password through
the header.

With the new Windows Update 832894 it is no longer possible to use
http(s)://username:password@server/resource.ext

Is there any other way to redirect to another page and pass the username and
password?

Thanks in advance!

/Magnus


Magnus Jardeby
2/6/2004 11:04:42 AM
Thanks for your answer!

Do you have an example of sending the information as the "Authentication"
request header in VB?

/Magnus

[quoted text, click to view]

David Wang [Msft]
2/7/2004 4:18:57 PM
No, I do not have an example.

I do not think it is possible with VB; you'd need a custom web browser since
the web browser controls the TCP connection and what is sent over it.

This is why I say you should re-think your custom authentication scheme.

What you are doing is analogous to printing out the username/password on the
web page and asking the browser to enter it in the following login dialog
box -- except you're automatically entering it. This isn't authentication
unless you're using some other scheme to map username/password to this
public username/password, but in that case, you can do the same thing by
using cookies and changing the Anonymous User credentials in IIS

--
//David
IIS
This posting is provided "AS IS" with no warranties, and confers no rights.
//
[quoted text, click to view]
Thanks for your answer!

Do you have an example of sending the information as the "Authentication"
request header in VB?

/Magnus

[quoted text, click to view]


AddThis Social Bookmark Button