Passing User Credentials to site running under Integrated Security

Discussion in 'ASP .Net' started by cdlipfert@hotmail.com, Jun 7, 2005.

  1. Guest

    Our intranet is running under windows integrated security. We have
    domain users that want to access our intranet site via ssl vpn. SSL
    VPN can not authenticate against services that run under windows
    integrated security. In order to get around this issue it seems that we
    would need to create a login page on a separate site that runs under
    anonymous security. Then pass the users credentials to the site
    running under integrated security. Has anyone had this issue or done
    anything like this before? Is it even possible to pass user credentils
    to a site running under integrated security?
    , Jun 7, 2005
    #1
    1. Advertising

  2. <> wrote in message
    news:...
    > Our intranet is running under windows integrated security. We have
    > domain users that want to access our intranet site via ssl vpn. SSL
    > VPN can not authenticate against services that run under windows
    > integrated security.


    That's not necessarily true. Have you actually tested this from a VPN
    client?


    > In order to get around this issue it seems that we
    > would need to create a login page on a separate site that runs under
    > anonymous security. Then pass the users credentials to the site
    > running under integrated security.


    If Windows authentication really doesn't work, perhaps basic authentication
    might? This would allow you to support VPN clients with far less changes to
    your current application.


    > Has anyone had this issue or done
    > anything like this before? Is it even possible to pass user credentils
    > to a site running under integrated security?


    Yes, but without any problems. Are you actually seeing a specific problem?
    If so, what is it? If not, why not test authentication over VPN against a
    simple sample application?
    Nicole Calinoiu, Jun 7, 2005
    #2
    1. Advertising

  3. Guest

    Using a Cisco VPN client, everything works fine. We are using a thrid
    party product that does SSL VPN. VPN via http/ssl. This is where we
    run into problems. because the browser client cannot pass user
    credentials to our iis server which is set to run under integrated
    security.


    Nicole Calinoiu wrote:
    > <> wrote in message
    > news:...
    > > Our intranet is running under windows integrated security. We have
    > > domain users that want to access our intranet site via ssl vpn. SSL
    > > VPN can not authenticate against services that run under windows
    > > integrated security.

    >
    > That's not necessarily true. Have you actually tested this from a VPN
    > client?
    >
    >
    > > In order to get around this issue it seems that we
    > > would need to create a login page on a separate site that runs under
    > > anonymous security. Then pass the users credentials to the site
    > > running under integrated security.

    >
    > If Windows authentication really doesn't work, perhaps basic authentication
    > might? This would allow you to support VPN clients with far less changes to
    > your current application.
    >
    >
    > > Has anyone had this issue or done
    > > anything like this before? Is it even possible to pass user credentils
    > > to a site running under integrated security?

    >
    > Yes, but without any problems. Are you actually seeing a specific problem?
    > If so, what is it? If not, why not test authentication over VPN against a
    > simple sample application?
    , Jun 7, 2005
    #3
  4. Guest

    We are recieving the following error "HTTP Error 400 - Request is badly
    formed." I believe we are receiving the error because the SSL VPN
    client is attempting to send a Kerberos ticket and our IIS server is
    expecting NTLM.

    wrote:
    > Using a Cisco VPN client, everything works fine. We are using a thrid
    > party product that does SSL VPN. VPN via http/ssl. This is where we
    > run into problems. because the browser client cannot pass user
    > credentials to our iis server which is set to run under integrated
    > security.
    >
    >
    > Nicole Calinoiu wrote:
    > > <> wrote in message
    > > news:...
    > > > Our intranet is running under windows integrated security. We have
    > > > domain users that want to access our intranet site via ssl vpn. SSL
    > > > VPN can not authenticate against services that run under windows
    > > > integrated security.

    > >
    > > That's not necessarily true. Have you actually tested this from a VPN
    > > client?
    > >
    > >
    > > > In order to get around this issue it seems that we
    > > > would need to create a login page on a separate site that runs under
    > > > anonymous security. Then pass the users credentials to the site
    > > > running under integrated security.

    > >
    > > If Windows authentication really doesn't work, perhaps basic authentication
    > > might? This would allow you to support VPN clients with far less changes to
    > > your current application.
    > >
    > >
    > > > Has anyone had this issue or done
    > > > anything like this before? Is it even possible to pass user credentils
    > > > to a site running under integrated security?

    > >
    > > Yes, but without any problems. Are you actually seeing a specific problem?
    > > If so, what is it? If not, why not test authentication over VPN against a
    > > simple sample application?
    , Jun 7, 2005
    #4
  5. Ken Schaefer Guest

    Is there anything in the httperr.log file that might give you a clue as to
    why IIS thinks the request is badly formed?

    Cheers
    Ken

    --
    IIS Blog: www.adopenstatic.com/cs/blogs/ken/
    Web: www.adopenstatic.com


    <> wrote in message
    news:...
    : We are recieving the following error "HTTP Error 400 - Request is badly
    : formed." I believe we are receiving the error because the SSL VPN
    : client is attempting to send a Kerberos ticket and our IIS server is
    : expecting NTLM.
    :
    : wrote:
    : > Using a Cisco VPN client, everything works fine. We are using a thrid
    : > party product that does SSL VPN. VPN via http/ssl. This is where we
    : > run into problems. because the browser client cannot pass user
    : > credentials to our iis server which is set to run under integrated
    : > security.
    : >
    : >
    : > Nicole Calinoiu wrote:
    : > > <> wrote in message
    : > > news:...
    : > > > Our intranet is running under windows integrated security. We have
    : > > > domain users that want to access our intranet site via ssl vpn. SSL
    : > > > VPN can not authenticate against services that run under windows
    : > > > integrated security.
    : > >
    : > > That's not necessarily true. Have you actually tested this from a VPN
    : > > client?
    : > >
    : > >
    : > > > In order to get around this issue it seems that we
    : > > > would need to create a login page on a separate site that runs under
    : > > > anonymous security. Then pass the users credentials to the site
    : > > > running under integrated security.
    : > >
    : > > If Windows authentication really doesn't work, perhaps basic
    authentication
    : > > might? This would allow you to support VPN clients with far less
    changes to
    : > > your current application.
    : > >
    : > >
    : > > > Has anyone had this issue or done
    : > > > anything like this before? Is it even possible to pass user
    credentils
    : > > > to a site running under integrated security?
    : > >
    : > > Yes, but without any problems. Are you actually seeing a specific
    problem?
    : > > If so, what is it? If not, why not test authentication over VPN
    against a
    : > > simple sample application?
    :
    Ken Schaefer, Jun 8, 2005
    #5
  6. This sort of thing is not a general SSL VPN problem, so it might be a good
    idea to get in touch with the VPN vendor to see if this is a known issue
    with their product and if there might be some configuration changes you
    could apply to avoid it. Failing that, you might want to try allowing basic
    authentication on the app (after making sure the app requires https use).


    <> wrote in message
    news:...
    > We are recieving the following error "HTTP Error 400 - Request is badly
    > formed." I believe we are receiving the error because the SSL VPN
    > client is attempting to send a Kerberos ticket and our IIS server is
    > expecting NTLM.
    >
    > wrote:
    >> Using a Cisco VPN client, everything works fine. We are using a thrid
    >> party product that does SSL VPN. VPN via http/ssl. This is where we
    >> run into problems. because the browser client cannot pass user
    >> credentials to our iis server which is set to run under integrated
    >> security.
    >>
    >>
    >> Nicole Calinoiu wrote:
    >> > <> wrote in message
    >> > news:...
    >> > > Our intranet is running under windows integrated security. We have
    >> > > domain users that want to access our intranet site via ssl vpn. SSL
    >> > > VPN can not authenticate against services that run under windows
    >> > > integrated security.
    >> >
    >> > That's not necessarily true. Have you actually tested this from a VPN
    >> > client?
    >> >
    >> >
    >> > > In order to get around this issue it seems that we
    >> > > would need to create a login page on a separate site that runs under
    >> > > anonymous security. Then pass the users credentials to the site
    >> > > running under integrated security.
    >> >
    >> > If Windows authentication really doesn't work, perhaps basic
    >> > authentication
    >> > might? This would allow you to support VPN clients with far less
    >> > changes to
    >> > your current application.
    >> >
    >> >
    >> > > Has anyone had this issue or done
    >> > > anything like this before? Is it even possible to pass user
    >> > > credentils
    >> > > to a site running under integrated security?
    >> >
    >> > Yes, but without any problems. Are you actually seeing a specific
    >> > problem?
    >> > If so, what is it? If not, why not test authentication over VPN
    >> > against a
    >> > simple sample application?

    >
    Nicole Calinoiu, Jun 8, 2005
    #6
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Alexander Stojakovic

    Integrated Security under Win2K and WinXP

    Alexander Stojakovic, Jan 15, 2004, in forum: ASP .Net
    Replies:
    0
    Views:
    310
    Alexander Stojakovic
    Jan 15, 2004
  2. jadher
    Replies:
    1
    Views:
    3,565
    William F. Robertson, Jr.
    Oct 11, 2004
  3. =?Utf-8?B?UGF0cmljay5PLklnZQ==?=

    Passing credentials to windows integrated authentication

    =?Utf-8?B?UGF0cmljay5PLklnZQ==?=, Oct 26, 2004, in forum: ASP .Net
    Replies:
    3
    Views:
    3,499
    Girish bharadwaj
    Oct 26, 2004
  4. Michael Ames

    How to get integrated credentials from anonymous access

    Michael Ames, Nov 3, 2003, in forum: ASP .Net Security
    Replies:
    1
    Views:
    139
    Alexander Stojakovic
    Nov 4, 2003
  5. Selden McCabe

    Process Running Under Wrong Credentials

    Selden McCabe, Sep 2, 2004, in forum: ASP .Net Web Services
    Replies:
    0
    Views:
    108
    Selden McCabe
    Sep 2, 2004
Loading...

Share This Page