dynamically requesting windows authentication on a resource

Discussion in 'ASP .Net Security' started by z f, Aug 28, 2005.

  1. z f

    z f Guest

    Hi,

    I have a asp.net web application, and in one of my pages I would like to be
    able to request windows authentication on the fly, without the page
    configured for windows authenticatino in IIS.

    is this possible using some http header / return value?

    i can surely mimic IIS behavior returning access denied, but a key should be
    added and IIS have to accept the credentials of the client.

    TIA.
     
    z f, Aug 28, 2005
    #1
    1. Advertising

  2. Although you can dynamically request authentication by setting a 401 Status
    and also a WWW-Authenticate header you will not be able to process these I
    would think. What will you do with the NTLM hash that is produced?

    Why do you want to do this?

    This is a set of headers that IIS returns when a user requests an NTLM page.
    But if IIS is not configured to accept the NTLM header I do not know what
    happens.

    HTTP/1.1 401 Access Denied
    Server: Microsoft-IIS/5.1
    Date: Mon, 29 Aug 2005 19:10:54 GMT
    WWW-Authenticate: Negotiate
    WWW-Authenticate: NTLM
    Connection: close
    Content-Length: 4431
    Content-Type: text/html

    --
    Cheers

    Chris

    Chris Crowe [IIS MVP]
    http://blog.crowe.co.nz


    "z f" <> wrote in message
    news:...
    > Hi,
    >
    > I have a asp.net web application, and in one of my pages I would like to
    > be able to request windows authentication on the fly, without the page
    > configured for windows authenticatino in IIS.
    >
    > is this possible using some http header / return value?
    >
    > i can surely mimic IIS behavior returning access denied, but a key should
    > be added and IIS have to accept the credentials of the client.
    >
    > TIA.
    >
    >
     
    Chris Crowe [MVP], Aug 29, 2005
    #2
    1. Advertising

  3. You can definitely handle your own basic auth though. It is very "basic".
    :)

    However, this is not a good idea without SSL in the mix.

    Joe K.

    "Chris Crowe [MVP]" <> wrote in message
    news:...
    > Although you can dynamically request authentication by setting a 401
    > Status and also a WWW-Authenticate header you will not be able to process
    > these I would think. What will you do with the NTLM hash that is produced?
    >
    > Why do you want to do this?
    >
    > This is a set of headers that IIS returns when a user requests an NTLM
    > page. But if IIS is not configured to accept the NTLM header I do not know
    > what happens.
    >
    > HTTP/1.1 401 Access Denied
    > Server: Microsoft-IIS/5.1
    > Date: Mon, 29 Aug 2005 19:10:54 GMT
    > WWW-Authenticate: Negotiate
    > WWW-Authenticate: NTLM
    > Connection: close
    > Content-Length: 4431
    > Content-Type: text/html
    >
    > --
    > Cheers
    >
    > Chris
    >
    > Chris Crowe [IIS MVP]
    > http://blog.crowe.co.nz
    >
    >
    > "z f" <> wrote in message
    > news:...
    >> Hi,
    >>
    >> I have a asp.net web application, and in one of my pages I would like to
    >> be able to request windows authentication on the fly, without the page
    >> configured for windows authenticatino in IIS.
    >>
    >> is this possible using some http header / return value?
    >>
    >> i can surely mimic IIS behavior returning access denied, but a key should
    >> be added and IIS have to accept the credentials of the client.
    >>
    >> TIA.
    >>
    >>

    >
    >
     
    Joe Kaplan \(MVP - ADSI\), Aug 30, 2005
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. drago_8_8
    Replies:
    0
    Views:
    286
    drago_8_8
    Oct 8, 2004
  2. Dirc Khan-Evans
    Replies:
    1
    Views:
    933
    Karl Seguin
    Oct 17, 2005
  3. avishosh
    Replies:
    2
    Views:
    10,702
    avishosh
    Aug 8, 2004
  4. Heinrich Moser
    Replies:
    1
    Views:
    477
    Heinrich Moser
    Mar 27, 2008
  5. Dominick Baier [DevelopMentor]

    Windows authentication with impersonation - network resource access fails

    Dominick Baier [DevelopMentor], Mar 18, 2005, in forum: ASP .Net Security
    Replies:
    0
    Views:
    153
    Dominick Baier [DevelopMentor]
    Mar 18, 2005
Loading...

Share This Page