473,321 Members | 1,778 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,321 software developers and data experts.

Authentication: multiple auth types for one site

I'm looking for feedback on an authentication solution we are
considering for an ASP.NET 2.0 project.

The site will be accessed by both internal users who are logged into
the Windows domain, and external (business partner) users via the
internet.

The internal users are required to be authenticated via Windows Integrated Authentication (WIA), and
external users will be authenticated using a custom solution based on a
signed ticket that will be included as a query parameter in the URL.

We are considering implementing this as follows:

1. In IIS, enable anonymous authentication for all resources in the
site except a page called LogonInternal.aspx, which will be protected
by WIA.
2. On session start, perform the following checks:
a) check if a signed ticket is present in the request. If there is
not, then assume the session is for an internal user, and redirect to
LogonInternal.aspx. The OnLoad handler for this page gets the current
user id via WIA and uses this to complete session initialisation
activities (fetching authorisation information, etc from a database).
LogonInternal.aspx then redirects back to the original URL. (If the
request originated from outside the Windows domain it will be rejected
by WIA.)
b) If a signed ticket IS present in the request, then verify the
signature on the ticket, get the username out of the ticket and
complete session initialisation activities as above. Redirect back to
the current request URL, but with the ticket removed from the query
parameters.
If any of the above checks fail, the current session is invalidated and
an error is returned in the response.

I have prototyped the above and it appears to work fine, but some
concern has been expressed about enabling anonymous authentication
throughout the site (except for LogonInternal.aspx).

Can anyone recommend any alternatives that don't require the use of
anonymous authentication? Perhaps using Forms authentication? (If
forms authentication is used as an alternative to anonymous
authentication, it would still have to let internal users be
authenticated via WIA and external users via the ticket mechanism.)

Thanks in advance ...

Steve
Jan 23 '07 #1
0 1232

Sign in to post your reply or Sign up for a free account.

Similar topics

7
by: Michael Foord | last post by:
#!/usr/bin/python -u # 15-09-04 # v1.0.0 # auth_example.py # A simple script manually demonstrating basic authentication. # Copyright Michael Foord # Free to use, modify and relicense. #...
4
by: Barry | last post by:
The MS fix for IE broke how users access our site (if they patch their browsers), so I need a solution to get users logged onto our site transparently. Basically we used to log on to the site...
2
by: Buddy Ackerman | last post by:
If my web site is setup for NTLM authentication and the user is using IE the context.user.identity.name property is the domain user that is currently logged into the local client workstation. Wehen...
5
by: Samba | last post by:
Hi, I've a web application and I'm using Forms authentication. My app contains some pages that can be viewed by everyone and it doesn't require any authentication or authoization and these pages...
7
by: mircu | last post by:
Hi, I noticed weird behaviour with the site that is using forms authentication. I am logged to the site from the same machine from two browsers (opened separately, not ctrl-N) as different users...
2
by: code | last post by:
Hi, I have stumbled across an interesting problem regarding forms authentication over multiple sub domains. The topic has been covered in various forms online but never really gets a definitive...
5
by: Buddy Ackerman | last post by:
My app is a .NET forms app that runs in the taskbar and periodically polls a web service. I have a client that wants the app to integrate with their Active Directory. They do not want the user to...
2
by: Steve | last post by:
I'm looking for feedback on an authentication solution we are considering for an ASP.NET 2.0 project. The site will be accessed by both internal users who are logged into the Windows domain, and...
4
by: =?Utf-8?B?RmFyaWJh?= | last post by:
It know that we can use the following method http://msdn2.microsoft.com/en-us/library/eb0zx8fc.aspx to form authenticate across multiple applications. I have created an asp.net application...
0
by: DolphinDB | last post by:
Tired of spending countless mintues downsampling your data? Look no further! In this article, you’ll learn how to efficiently downsample 6.48 billion high-frequency records to 61 million...
0
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...
0
by: jfyes | last post by:
As a hardware engineer, after seeing that CEIWEI recently released a new tool for Modbus RTU Over TCP/UDP filtering and monitoring, I actively went to its official website to take a look. It turned...
0
by: ArrayDB | last post by:
The error message I've encountered is; ERROR:root:Error generating model response: exception: access violation writing 0x0000000000005140, which seems to be indicative of an access violation...
1
by: PapaRatzi | last post by:
Hello, I am teaching myself MS Access forms design and Visual Basic. I've created a table to capture a list of Top 30 singles and forms to capture new entries. The final step is a form (unbound)...
1
by: Defcon1945 | last post by:
I'm trying to learn Python using Pycharm but import shutil doesn't work
1
by: Shællîpôpï 09 | last post by:
If u are using a keypad phone, how do u turn on JavaScript, to access features like WhatsApp, Facebook, Instagram....
0
by: af34tf | last post by:
Hi Guys, I have a domain whose name is BytesLimited.com, and I want to sell it. Does anyone know about platforms that allow me to list my domain in auction for free. Thank you
0
by: Faith0G | last post by:
I am starting a new it consulting business and it's been a while since I setup a new website. Is wordpress still the best web based software for hosting a 5 page website? The webpages will be...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.