Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an IIS server that is a stand alone server not on the domain.

So users don't have to login to a local user database, Can I have the IIS server, authenticate users against the domain controller or atleast have the user's login name passed though to the IIS application?

It can be assumed that users will trust the website.

share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

I ran into a similar requirement when trying to figure out how to leverage Active Directory for BlogEngine.NET. After spending some time researching I was able to use Active Directory user accounts with the Basic Authentication .NET Membership framework.

This worked on my domain member web server but could easily work for non-domain member servers assuming you add the username and password to the configuration section of the web.config.

From my blog post about how to configure:

Add an entry into the section pointing to your domain controller.

<add name="ADConnectionString" connectionString="LDAP://server.domain.com/DC=domain,DC=com" />

Notice the first part of the LDAP:// syntax specifies the name of the domain controller (server.domain.com). You have a couple of options here. You can specify the Fully Qualified Domain Name as shown in the example; you can specify the relativeDistinguishedNamek (ex. server); you can specify the IP Address of the domain controller (ex. 192.168.1.10); or for more redundancy you can specify just the domain name (ex. domain.com).

Make your section look like the following:

<membership defaultProvider="MyADMembershipProvider">
      <providers>
        <add name="MyADMembershipProvider"
                 type="System.Web.Security.ActiveDirectoryMembershipProvider, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
                 connectionStringName="ADConnectionString"
                 attributeMapUsername="sAMAccountName"
                 enableSearchMethods="true"/>
      </providers>
</membership>

You will notice that I did not configure a username and password for connecting into Active Directory. That's because I am running BlogEngine on a domain member server and the IIS services are running under an application pool using Network Services account. If you must use explicit credentials then you can add connectionUsername and connectionPassword to the MyADMembershipProvider entry with the appropriate information.

share|improve this answer
add comment

I'd recommend using an LDAPS call if possible instead of LDAP. I'd also recommend using SSL if you're going to start passing you domain passwords in plain text.

share|improve this answer
add comment

Whilst I agree with the encrypted LDAP, also encrypt the domain password in the config file as well.... (keys under the mat, or behind the plant pot?)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.