single web app for both external users and domain users

Discussion in 'ASP .Net' started by bitshift, Jun 22, 2007.

  1. bitshift

    bitshift Guest

    Ive been asked to allow internal (domain authenticated) users to get in to
    my asp.net web application, while everyone else should use the login form.
    One way ive seen others doing this, is to configure the application in IIS
    to use windows authentication, uncheck anonymous, so as to have the browser
    pass in the User.Identity value.

    Then, when when a visotor hits the site, I can check if we have a domain
    user with the User.Identity, and automatically log them in using a common
    login name that is setup in the database. If the user.Identity is empty,
    then force them to login as usual.

    Sound reasonable ?
    bitshift, Jun 22, 2007
    #1
    1. Advertising

  2. bitshift

    bruce barker Guest

    its much tricker than this. if you turn off anonymous, no one can access
    the site with a successful domain login.

    for the browser to send credentials, the server must send a 401 (access
    denied). the browser then send some credentials. the server will return
    another 401 if invalid, so the user can try again.

    if you turn on anonymous, then iis never sends a 401 and the browser
    will never send the user credentials.

    the easiest solution is if the users ipaddress is internal, send a 401,
    if not redirect to forms login.

    -- bruce (sqlwork.com)




    bitshift wrote:
    > Ive been asked to allow internal (domain authenticated) users to get in to
    > my asp.net web application, while everyone else should use the login form.
    > One way ive seen others doing this, is to configure the application in IIS
    > to use windows authentication, uncheck anonymous, so as to have the browser
    > pass in the User.Identity value.
    >
    > Then, when when a visotor hits the site, I can check if we have a domain
    > user with the User.Identity, and automatically log them in using a common
    > login name that is setup in the database. If the user.Identity is empty,
    > then force them to login as usual.
    >
    > Sound reasonable ?
    >
    >
    bruce barker, Jun 22, 2007
    #2
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.

Share This Page