basic authentication by code -- help needed!!!

[ami.turgman]

Hi,

I'm working on a content pages web site engine which deifnes 2 types
of security methods.
some of the pages don't need authentication and can be accessed by
everyone, while other pages (the same aspx page- different content)
requires to have Basic Authentication, ie. having the popup window
open at the client, authenticating him before he can view the content.
this behavior is defined by configuration of each content page which
is accessed programatically.

the question- is there a way of having the basic authentication popup
by code? i want to check the page's property, and if this is a basic
authentication page, then i want the popup appear to the user...
i searched and couldn't find anything about this anywhere, i would
really appriciate any help regardng this

Thanks in advance,
Ami.

 

[Dominick Baier]

IIS sends the necessary authentication headers to IE whenever he sees an
HTTP 401 coming from ASP.NET - so yes - you could do:

Response.StatusCode = 401;
Request.CompleteRequest();

have not compiled it - but should work

 

[Joe Kaplan]

Server must also add a "WWW-Authenticate: Basic realm=xxxx" header so that
the browser will know to respond with Basic auth. If client sends an
authorization header, server must check for Basic auth request header,
decode it properly and verify the credentials.

If the credentials are going to be verified against Windows/AD, it is much
more straightforward to just check the basic authentication checkbox and let
IIS do all the work.

Joe K.

 

[Dominick Baier]

i thought it is already configured like that:

"while other pages (the same aspx page- different content)
requires to have Basic Authentication, ie. having the popup window
open at the client, authenticating him before he can view the content.
this behavior is defined by configuration of each content page which
is accessed programatically."

 

[Joe Kaplan]

I couldn't quite tell what he was doing based on what he said. I didn't
know if he wanted to implement the whole basic auth protocol himself or some
hybrid. If he has both anonymous and basic enabled in IIS, then sending a
401 response may be adequate in this case. I've never actually tried that.


Joe K.

 

[Dominick Baier]

well - thats exactly how the <authorization> element does its job...