dynamically requesting windows authentication on a resource

[z f]

Hi,

I have a asp.net web application, and in one of my pages I would like to be
able to request windows authentication on the fly, without the page
configured for windows authenticatino in IIS.

is this possible using some http header / return value?

i can surely mimic IIS behavior returning access denied, but a key should be
added and IIS have to accept the credentials of the client.

TIA.

 

[Chris Crowe [MVP]]

Although you can dynamically request authentication by setting a 401 Status
and also a WWW-Authenticate header you will not be able to process these I
would think. What will you do with the NTLM hash that is produced?

Why do you want to do this?

This is a set of headers that IIS returns when a user requests an NTLM page.
But if IIS is not configured to accept the NTLM header I do not know what
happens.

HTTP/1.1 401 Access Denied
Server: Microsoft-IIS/5.1
Date: Mon, 29 Aug 2005 19:10:54 GMT
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
Connection: close
Content-Length: 4431
Content-Type: text/html

--
Cheers

Chris

Chris Crowe [IIS MVP]
http://blog.crowe.co.nz

 

[Joe Kaplan \(MVP - ADSI\)]

You can definitely handle your own basic auth though. It is very "basic".


However, this is not a good idea without SSL in the mix.

Joe K.

Although you can dynamically request authentication by setting a 401
Status and also a WWW-Authenticate header you will not be able to process
these I would think. What will you do with the NTLM hash that is produced?

Why do you want to do this?

This is a set of headers that IIS returns when a user requests an NTLM
page. But if IIS is not configured to accept the NTLM header I do not know
what happens.

HTTP/1.1 401 Access Denied
Server: Microsoft-IIS/5.1
Date: Mon, 29 Aug 2005 19:10:54 GMT
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
Connection: close
Content-Length: 4431
Content-Type: text/html

--
Cheers

Chris

Chris Crowe [IIS MVP]
http://blog.crowe.co.nz

Hi,

I have a asp.net web application, and in one of my pages I would like to
be able to request windows authentication on the fly, without the page
configured for windows authenticatino in IIS.

is this possible using some http header / return value?

i can surely mimic IIS behavior returning access denied, but a key should
be added and IIS have to accept the credentials of the client.

TIA.