1

I am updating an old ASP .NET 3.5 webforms application which uses forms authentication. The requirement is that it needs to automatically log in authenticated domain users whilst still allowing external users to log in manually as before.

To be clear: I need to find out the name of the currently logged in user if they are on the same domain as the server and use this information to bypass the old login system. Not all users will be on the network.

The problem I am having is that although I can get the logged in user from .NET's Request.LogonUserIdentity, I have to disable anonymous access on the relevant page(s) before it will work. What happens is that anyone who is not recognised will receive a login prompt to log in to the domain, but I don't want this as some users do not have user accounts within the domain.

The only solution I can think of is to have a special logon page for domain users that automatically redirects. But it would be nicer if they could just visit any page directly.

The site is running on Windows Server 2003 R2 with IIS 6.0.

Thanks.

Improve this question

3 Answers 3

Reset to default
3

The short answer is no. Unless you have Windows Authentication exlcusively turned on (and all other authentication methods disabled) users won't be authenticated against the domain or the local machine... and you won't have access to this information programmatically.

The long answer is also no. Anonymous Authentication will override Windows Authentication if they are both enabled... IIS will skip other methods of authentication if Anonymous is enabled. If Windows authentication is enabled (any Anonymous is disabled) IIS will send the Kerberos / NTLM challenge and only then (after prompting) will the browser send credentials. Internet Explorer will send Kerberos info without prompting if within the intranet zone. -Chris

Improve this answer
1
  • When I first searched Google before posting I guess I wasn't using the right keywords because I later discovered a load of articles confirming what you said. The strange thing is that I thought I had it working at one point, but the browser must have been caching credentials.
    – James
    May 17, 2012 at 9:57
0

probably this solution is not available OOTB (out of the box).

We have SharePoint 2010 in our environment and when opening via IE it does not ask for the credentials. All other places it ask for the domain user name and password every time you visit. My believe is if there would have been any solution, MS would have provided it with SharePoint as this prompt is very annoying.

Previously, there was a similar requirement for one project which was later diverted to Form Authentication (based on revised business rules). Now, I am expecting to face the similar requirement in the near future and I have not seen any working sample for this requirement since the days of past scenario.

Other than asking users to use IE (for this stuff), the immediate solution that comes to my mind is to have a browser plugin that will communicate with active directory and handle this issue at the backend. Unfortunately, even if valid, it is not possible for majority of the developers facing this issue (including me) to go for this .

Improve this answer
0

I've been researching this as well, and racking my brain on how to get this to work, and finally figured it out. So I figure I'd give everyone my way of doing it. It's not clean, but it'll work. This process could be implemented for other pages and method of creating pages.

I created a page using PHP with a login form. It uses LDAPS connection to authenticate the users. This is working fine. Then I wanted to be adventurous and change it, so that people who are already on the domain, doesn't have to log in. This work fine by reading the $_SERVER['REMOTE_USER'] credential field, but requires me to turn on Windows Authentication. This is fine and dandy, but it completely ignores my Login Form, and there are a few users that are debug and test users and contractors that we didn't want to add into AD, so they're kept up in a MySQL database. Without the login form, they cant log in!! Also, if the user uses Firefox, it doesn't pass the $_SERVER['REMOTE_USER'] credentials anyway.

To fix the login page, I copied the page, add a _SSO (single sign on) after it. So now my application is "www.mywebsite.com/testapp", would be "www.mywebsite.com/testapp_sso/". One will have Windows Authentication, one with Anonymous Login. Then, I use IIS7 URL Rewrite, so when they access the testapp, and their IP address, which is $_SERVER['REMOTE_HOST'], is within our subnet, it would do the URL rewrite to the _SSO folder.

Next step, you can also add another URL redirect rule for "firefox" _SERVER["HTTP_USER_AGENT"]. So this would force everyone, even if they are in the IP range, to fall to the non _SSO page. So even if they are on our network, Firefox users still see the good ol' login page that everyone else sees instead of the Windows Authentication pop up that's horrid.

Final step, is to add a URL masking, so that the users have no clue that they're on testapp_SSO, or testapp.

That will be all for the users side. But now everytime you want to update one page, you have to copy it over to the _SSO folder as well. You could create a sync using some sync software, but you can also create a hard Symbolic Link! The permissions will all work between the two folders, and you only have to update one.

Yes yes, if this was Linux, it'd be so much easier. But we have to use IIS here.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .