Some Advice on Writing a customer Membership Provider

[Bryan]

Hello All,

I think I need to implement my own membership provider, but I am not sure.

Here is the situation:
I am creating an Intranet App and I have 2 different users, Active Directory
(Internal Office) and users that I don't want in active directory, I will
call these "Stores" that are located off the network on a VPN.

This is what I want to happen:
When an Internal Office user accesses the site, I want to use Windows
Authentication, since it will know who they are via there LogonUserIdentity.
If the same user is out on the road and accesses the VPN via ther laptop, I
want them to be able to Login using AD and therefore use Forms
Authentication.

When a "Store" comes to the page I want to use an exsisting data store on
SQL Server to authenticate them.

I also want to use this same data store to hold personalization settings for
AD and "Store" users.

The only way I can think of to do this is:

1. Use "Forms Authentication"
2. Use a login control
3. Somehow override the login control when a user enters the site in with a
valid Request.UserLoginIdentity, and "auto login" so they arent prompted
with user and pass.
4. When a user enters the site without a valid UserLoginIdentity then prompt
with Login control, user and pass. If the username is a "Store", which can
be determined by IPAddress, then use the Data Store, if not then use AD
authentication.

If I can get the above to work that would be great!

I have tried to create my own provider class too. I just cannot get it to
work, I don't think the web app is even accessing it, I set break points in
the class even in the Initialize method and its not even hit.

Some advice on how I should do this would be great!

Thanks,
Bryan

 

[[MSFT]]

Hello Bryan,

The problem is that you couldn't set the authentication in IIS for the web
application. For example, if you enable anonymous access in IIS for the
virtual folder so that "Stores" users can access the page,
LogonUserIdentity won't return the correct user name for Office user . ( It
will return IUSER_computername instead.) If you disable anonymous access,
the "Stores" users will be not able to access the virtual folder.

You may consider creating two seperated web applications for the two type
of users. They may share same UI, logic code and back database.

Luke