Redirecting via windowd authentication

[darrel]

I'm trying to set up a usercontrol that I can put on specific pages to
authenticate people via their network login on our intranet. I have this in
the config file:

<authentication mode="Windows" />

<authorization>
<allow roles="ServerName\GroupName" />
<deny users="*" />
</authorization>

And then I'm using this on the control:

Dim user As WindowsPrincipal =
CType(System.Threading.Thread.CurrentPrincipal, WindowsPrincipal)
If user.IsInRole("J00000scourtnet\BailBondsDBAdmin") Then
'do nothing, ie, let them in
else server.Transfer(request.ApplicationPath & "/accessError.aspx")
End If

I'm having two problems:

1) Every time I access a page with this control, it asks for my network
username and password. Is there a way to get this automatically from my
machine or from the network automatically?

2) The redirect isn't working because the authentication is happening prior
to page load. Ie, if I'm not part of that group, it never loads the page for
me to do the redirect. My thought to solve this would be to remove the DENY
statement, which then allows me to get to the actual page, where, in theory,
I could then check the user and do the if/then. However, if I remove the
DENY statement, then the control never prompts me for my network ID, and
instead logs me as 'Iuser'.

Am I completely way off base on how I'm implementing this?

In the end, I'd like to be able to grab the network userID, see if that user
belongs to a group set up on the server, and, if so, load the page,
otherwise, redirect to the error.

For now, with my original setup, it's secure, as if you're not in the group,
you can't get in...however it's aesthetically mess (no formal error page,
just a generic 'permission denied' error in IE).

-Darrel

[Patrick.O.Ige]

Hi Darrel u are on the right way but u are missing somethings!!

Try reading through this <authorization> Element:
http://msdn.microsoft.com/library/de...ionsection.asp

To get the User logged on:- <%=User.Identity.Name%>
Are u impersonating ? If not place :-
<identity impersonate="true"/> in your Web.Config!!

Any more Questions Post it..
Enjoy!
Patrick


"darrel" wrote:

I'm trying to set up a usercontrol that I can put on specific pages to
authenticate people via their network login on our intranet. I have this in
the config file:

<authentication mode="Windows" />

<authorization>
<allow roles="ServerName\GroupName" />
<deny users="*" />
</authorization>

And then I'm using this on the control:

Dim user As WindowsPrincipal =
CType(System.Threading.Thread.CurrentPrincipal, WindowsPrincipal)
If user.IsInRole("J00000scourtnet\BailBondsDBAdmin") Then
'do nothing, ie, let them in
else server.Transfer(request.ApplicationPath & "/accessError.aspx")
End If

I'm having two problems:

1) Every time I access a page with this control, it asks for my network
username and password. Is there a way to get this automatically from my
machine or from the network automatically?

2) The redirect isn't working because the authentication is happening prior
to page load. Ie, if I'm not part of that group, it never loads the page for
me to do the redirect. My thought to solve this would be to remove the DENY
statement, which then allows me to get to the actual page, where, in theory,
I could then check the user and do the if/then. However, if I remove the
DENY statement, then the control never prompts me for my network ID, and
instead logs me as 'Iuser'.

Am I completely way off base on how I'm implementing this?

In the end, I'd like to be able to grab the network userID, see if that user
belongs to a group set up on the server, and, if so, load the page,
otherwise, redirect to the error.

For now, with my original setup, it's secure, as if you're not in the group,
you can't get in...however it's aesthetically mess (no formal error page,
just a generic 'permission denied' error in IE).

-Darrel

[Darrel]

> To get the User logged on:- <%=User.Identity.Name%>

Are u impersonating ? If not place :-
<identity impersonate="true"/> in your Web.Config!!

Oops...actually, that is in there. Sorry for not including that in the
explanation.

-Darrel

[Patrick.O.Ige]

So Darrel..
Is that working?

"Darrel" wrote:

To get the User logged on:- <%=User.Identity.Name%>
Are u impersonating ? If not place :-
<identity impersonate="true"/> in your Web.Config!!

Oops...actually, that is in there. Sorry for not including that in the
explanation.

-Darrel

[darrel]

> So Darrel..

Is that working?

No. Here's the code I'm using:

<authentication mode="Windows" />
<identity impersonate = "true"></identity>
<authorization>
<allow roles="BUILTIN\Administrators" />
<allow roles="J00000SCOURTNET\BailBondsDBAdmin" />
<deny users="*" />
</authorization>

Dim user As WindowsPrincipal =
CType(System.Threading.Thread.CurrentPrincipal, WindowsPrincipal)
If user.IsInRole("J00000scourtnet\BailBondsDBAdmin") Then
'do nothing
else
'redirect to error page
end if
It seems the problem is that all the authentication is happening via the
application PRIOR to me even loading my page to check for roles. My thinking
was to remove the DENY USERS part so that everyone at least gets to the ASPX
page. However, if I do that, the ASPX page no longer sees their network ID,
but rather as a generic 'iuser'

-Darrel

[Kenneth P]

Darrel,

No need for anything special in web.config, no impersonate, no roles

Sub WindowsLogin()
Dim idName As String
idName = User.Identity.Name
'idName = "server\thore"
Dim lcUser As String = ""
Dim iPos As Integer
If InStr(1, idName, "\") > 0 Then
' separare server\ from server\username
iPos = InStr(1, idName, "\")
lcUser = Mid(idName, iPos + 1)

Now lcUser contains only the user name

If you also want a SqlServer Database with the user name you could use a
datareader and

dim dr as sqldatareader

If dr.read() then

response.redirect("anypage...

Kenneth P

"darrel" wrote:

So Darrel..
Is that working?

No. Here's the code I'm using:

<authentication mode="Windows" />
<identity impersonate = "true"></identity>
<authorization>
<allow roles="BUILTIN\Administrators" />
<allow roles="J00000SCOURTNET\BailBondsDBAdmin" />
<deny users="*" />
</authorization>

Dim user As WindowsPrincipal =
CType(System.Threading.Thread.CurrentPrincipal, WindowsPrincipal)
If user.IsInRole("J00000scourtnet\BailBondsDBAdmin") Then
'do nothing
else
'redirect to error page
end if
It seems the problem is that all the authentication is happening via the
application PRIOR to me even loading my page to check for roles. My thinking
was to remove the DENY USERS part so that everyone at least gets to the ASPX
page. However, if I do that, the ASPX page no longer sees their network ID,
but rather as a generic 'iuser'

-Darrel