authentication - what is being used

[Stephanie Stowe]

I am new to ASP.NET having come from ASP classic background. I need to
understand authentication. I have a server running IIS which contains an
ASP.NET app. On IIS the app has both anonymous and Windows Integrated
Authentication enabled. In the ASP.NET app, the web.config file contains

<authentication mode="Windows" />

The help on this element says of this setting

Specifies Windows authentication as the default authentication mode. Use
this mode when using any form of Microsoft Internet Information Services
(IIS) authentication: Basic, Digest, Integrated Windows authentication
(NTLM/Kerberos), or certificates.

A user running IE6 (which is all of our users) also has User Authentication
settings in IE from which one might choose Anonymous, Automatic logon only
in Intranet zone, Automatic logon with current user name and password and
Prompt for user name and password.

I am trying to determine which set of credentials are being used when a
customer logs into the site. The only thing I do not know (and cannot know
until 11:30 or so when west coast shows up) is exactly what the IE
authentication settings are. The site is in the IntERnet zone. And I *think*
that they have Automatic logon only in Intranet zone.

My question is, with all these settings in different places, how is the
actual set of credentials determined?

Thanks!

 

[Teemu Keiski]

It's the set of credentials that the IIS has access to (the ones the web
server knows about). So if client and server share same server (e.g domain
etc) , then they could have common user dbs in the sae domain or trusted
zone, then user's logon detals on his/her desktop could be recognized at the
web application (and no extra logon would be required)

Here is more information about Windows Authentication in this guide:

(Building Secure ASP.NET Applications: Authentication, Authorization, and
Secure Communication)
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetlpmsdn.asp

 

[bruce barker]

when IIS responds with a authenication required response, it sends a list
(based on how you configured the website) of all authenication protocols it
will accept, in order of preference. the browser is free to pick any it
likes.

typically IE, if nt c/r is available and the host is trusted the browser
will send the users current logon credentials.

-- bruce (sqlwork.com)

 

[Scott Allen]

Hi Stephanie:

In addition to other's comments, there is an ASP.NET Identity Matrix
on MSDN which might help:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetAP05.asp