Windows authentication over remoting... possible?

[ThunderMusic]

Hi,

I have to develop an application that will consist of a service and a
windows forms application... the service could be on a distant server but I
need to authenticate the user as being part of the same domain. so when the
application starts, I can send something to the remote service and query for
some objects and the service can give me the objects if I'm the right user
(part of the right group). I don't want to send username and password nor
password hash over the network so if there is a better way (just like SQL
server does or many other apps), I would like to know it (maybe if you have
a link)

Thanks

ThunderMusic

[Nicholas Paldino [.NET/C# MVP]]

ThunderMusic,

Not easily. You can host your remoted objects in IIS, and then it would
use the authentication mechanism that you have configured in IIS.

Also, I believe this will force you to design your objects in a certain
way (for stateless calls, since the mechanism for HTTP is stateless). I
could be wrong here.

I would honestly not use or recommend remoting as a distributed object
technology. If you have to develop your app now (meaning, get it out the
door tomorrow), then I would suggest using COM+/Enterprise Services.

If you have some time to spare, and don't mind developing with
pre-release software, I would look into Windows Communication Foundation.

Either way, remoting is a dead-end in my book.

Hope this helps.

--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"ThunderMus ic" <No************ *************@N oSpAm.comwrote in message
news:eR******** ******@TK2MSFTN GP04.phx.gbl...

Hi,

I have to develop an application that will consist of a service and a
windows forms application... the service could be on a distant server but
I need to authenticate the user as being part of the same domain. so when
the application starts, I can send something to the remote service and
query for some objects and the service can give me the objects if I'm the
right user (part of the right group). I don't want to send username and
password nor password hash over the network so if there is a better way
(just like SQL server does or many other apps), I would like to know it
(maybe if you have a link)

Thanks

ThunderMusic

[Tom Spink]

ThunderMusic wrote:

Hi,

I have to develop an application that will consist of a service and a
windows forms application... the service could be on a distant server but
I need to authenticate the user as being part of the same domain. so when
the application starts, I can send something to the remote service and
query for some objects and the service can give me the objects if I'm the
right user (part of the right group). I don't want to send username and
password nor password hash over the network so if there is a better way
(just like SQL server does or many other apps), I would like to know it
(maybe if you have a link)

Thanks

ThunderMusic

Hi ThunderMusic,

This may be of help:

<UrlWillWrap>
http://msdn.microsoft.com/library/de...SecNetch11.asp
</UrlWillWrap>

--
Hope this helps,
Tom Spink

[ThunderMusic]

Ok, I found the WindowsPrincipa l class, and it's serializable. Does an
instance of this class guaranty the user is logged on a computer and has
been authenticated or is there a way to query the domain server if the user
is a rightful user? I mean, I must be sure the user making the request (or
query) is who he claims to be and is logged on the domain. My app does not
allow impersonnation, but I don't want anybody trying to impersonnate
someone on my network and claim being, let's say, the president of the
company and start making anything he wants with the remote objects... you
know what I mean? I need a way to secure things so only an authenticated
user or a user I can authenticate can have access to the objects the service
is providing. And I definitly need to know the domain groups this user
belongs to...

Thanks

ThunderMusic

"ThunderMus ic" <No************ *************@N oSpAm.comwrote in message
news:eR******** ******@TK2MSFTN GP04.phx.gbl...

Hi,

I have to develop an application that will consist of a service and a
windows forms application... the service could be on a distant server but
I need to authenticate the user as being part of the same domain. so when
the application starts, I can send something to the remote service and
query for some objects and the service can give me the objects if I'm the
right user (part of the right group). I don't want to send username and
password nor password hash over the network so if there is a better way
(just like SQL server does or many other apps), I would like to know it
(maybe if you have a link)

Thanks

ThunderMusic

[Nicholas Paldino [.NET/C# MVP]]

ThunderMusic,

Unfortunately, no, it does not allow that. All it is is a
representation of a user. Anyone could theoretically make one and send it
to you. It doesn't tell you if it is logged on or not.
--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"ThunderMus ic" <No************ *************@N oSpAm.comwrote in message
news:uh******** ******@TK2MSFTN GP05.phx.gbl...

Ok, I found the WindowsPrincipa l class, and it's serializable. Does an
instance of this class guaranty the user is logged on a computer and has
been authenticated or is there a way to query the domain server if the
user is a rightful user? I mean, I must be sure the user making the
request (or query) is who he claims to be and is logged on the domain. My
app does not allow impersonnation, but I don't want anybody trying to
impersonnate someone on my network and claim being, let's say, the
president of the company and start making anything he wants with the
remote objects... you know what I mean? I need a way to secure things so
only an authenticated user or a user I can authenticate can have access to
the objects the service is providing. And I definitly need to know the
domain groups this user belongs to...

Thanks

ThunderMusic

"ThunderMus ic" <No************ *************@N oSpAm.comwrote in message
news:eR******** ******@TK2MSFTN GP04.phx.gbl...

>Hi,

I have to develop an application that will consist of a service and a
windows forms application... the service could be on a distant server
but I need to authenticate the user as being part of the same domain. so
when the application starts, I can send something to the remote service
and query for some objects and the service can give me the objects if I'm
the right user (part of the right group). I don't want to send username
and password nor password hash over the network so if there is a better
way (just like SQL server does or many other apps), I would like to know
it (maybe if you have a link)

Thanks

ThunderMusic

[schneider]

Just check on the client, put a strong name on the client. You can event do
some link demands.

Schneider

"ThunderMus ic" <No************ *************@N oSpAm.comwrote in message
news:eR******** ******@TK2MSFTN GP04.phx.gbl...

Hi,

I have to develop an application that will consist of a service and a
windows forms application... the service could be on a distant server but

I

need to authenticate the user as being part of the same domain. so when

the

application starts, I can send something to the remote service and query

for

some objects and the service can give me the objects if I'm the right user
(part of the right group). I don't want to send username and password nor
password hash over the network so if there is a better way (just like SQL
server does or many other apps), I would like to know it (maybe if you

have

a link)

Thanks

ThunderMusic

[ThunderMusic]

ok, so is there a way I can get the token Windows send us when we log on and
send it to my service so the service can verify with the domain server if
this token is valid?

thanks

ThunderMusic

"Nicholas Paldino [.NET/C# MVP]" <mv*@spam.guard .caspershouse.c omwrote in
message news:OP******** ******@TK2MSFTN GP05.phx.gbl...

ThunderMusic,

Unfortunately, no, it does not allow that. All it is is a
representation of a user. Anyone could theoretically make one and send it
to you. It doesn't tell you if it is logged on or not.
--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"ThunderMus ic" <No************ *************@N oSpAm.comwrote in message
news:uh******** ******@TK2MSFTN GP05.phx.gbl...

>Ok, I found the WindowsPrincipa l class, and it's serializable. Does an
instance of this class guaranty the user is logged on a computer and has
been authenticated or is there a way to query the domain server if the
user is a rightful user? I mean, I must be sure the user making the
request (or query) is who he claims to be and is logged on the domain. My
app does not allow impersonnation, but I don't want anybody trying to
impersonnate someone on my network and claim being, let's say, the
president of the company and start making anything he wants with the
remote objects... you know what I mean? I need a way to secure things
so only an authenticated user or a user I can authenticate can have
access to the objects the service is providing. And I definitly need to
know the domain groups this user belongs to...

Thanks

ThunderMusic

"ThunderMusi c" <No************ *************@N oSpAm.comwrote in message
news:eR******* *******@TK2MSFT NGP04.phx.gbl.. .

>>Hi,

I have to develop an application that will consist of a service and a
windows forms application... the service could be on a distant server
but I need to authenticate the user as being part of the same domain. so
when the application starts, I can send something to the remote service
and query for some objects and the service can give me the objects if
I'm the right user (part of the right group). I don't want to send
username and password nor password hash over the network so if there is
a better way (just like SQL server does or many other apps), I would
like to know it (maybe if you have a link)

Thanks

ThunderMusi c

[ThunderMusic]

ok, I answered a part of my question :
System.Security .Principal.Wind owsIdentity.Get Current().Token .... So now is
there a way I can deal with this in my service? can I sen the Windows
Identity instance over remoting?

thanks

ThunderMusic

"ThunderMus ic" <No************ *************@N oSpAm.comwrote in message
news:OA******** ******@TK2MSFTN GP04.phx.gbl...

ok, so is there a way I can get the token Windows send us when we log on
and send it to my service so the service can verify with the domain server
if this token is valid?

thanks

ThunderMusic

"Nicholas Paldino [.NET/C# MVP]" <mv*@spam.guard .caspershouse.c omwrote
in message news:OP******** ******@TK2MSFTN GP05.phx.gbl...

>ThunderMusic ,

Unfortunately, no, it does not allow that. All it is is a
representati on of a user. Anyone could theoretically make one and send
it to you. It doesn't tell you if it is logged on or not.
--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"ThunderMusi c" <No************ *************@N oSpAm.comwrote in message
news:uh******* *******@TK2MSFT NGP05.phx.gbl.. .

>>Ok, I found the WindowsPrincipa l class, and it's serializable. Does an
instance of this class guaranty the user is logged on a computer and has
been authenticated or is there a way to query the domain server if the
user is a rightful user? I mean, I must be sure the user making the
request (or query) is who he claims to be and is logged on the domain.
My app does not allow impersonnation, but I don't want anybody trying to
impersonnat e someone on my network and claim being, let's say, the
president of the company and start making anything he wants with the
remote objects... you know what I mean? I need a way to secure things
so only an authenticated user or a user I can authenticate can have
access to the objects the service is providing. And I definitly need to
know the domain groups this user belongs to...

Thanks

ThunderMusi c

"ThunderMusic " <No************ *************@N oSpAm.comwrote in message
news:eR****** ********@TK2MSF TNGP04.phx.gbl. ..
Hi,

I have to develop an application that will consist of a service and a
windows forms application... the service could be on a distant server
but I need to authenticate the user as being part of the same domain.
so when the application starts, I can send something to the remote
service and query for some objects and the service can give me the
objects if I'm the right user (part of the right group). I don't want
to send username and password nor password hash over the network so if
there is a better way (just like SQL server does or many other apps), I
would like to know it (maybe if you have a link)

Thanks

ThunderMus ic

[Nicholas Paldino [.NET/C# MVP]]

ThunderMusic,

I have to ask, why not use one of the two solutions I posted earlier?
Trying to do this yourself will lead to a good number of holes in your
solution.

--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"ThunderMus ic" <No************ *************@N oSpAm.comwrote in message
news:O1******** ********@TK2MSF TNGP05.phx.gbl. ..

ok, I answered a part of my question :
System.Security .Principal.Wind owsIdentity.Get Current().Token .... So now
is there a way I can deal with this in my service? can I sen the Windows
Identity instance over remoting?

thanks

ThunderMusic

"ThunderMus ic" <No************ *************@N oSpAm.comwrote in message
news:OA******** ******@TK2MSFTN GP04.phx.gbl...

>ok, so is there a way I can get the token Windows send us when we log on
and send it to my service so the service can verify with the domain
server if this token is valid?

thanks

ThunderMusic

"Nicholas Paldino [.NET/C# MVP]" <mv*@spam.guard .caspershouse.c omwrote
in message news:OP******** ******@TK2MSFTN GP05.phx.gbl...

>>ThunderMusi c,

Unfortunately, no, it does not allow that. All it is is a
representatio n of a user. Anyone could theoretically make one and send
it to you. It doesn't tell you if it is logged on or not.
--
- Nicholas Paldino [.NET/C# MVP]
- mv*@spam.guard. caspershouse.co m

"ThunderMusic " <No************ *************@N oSpAm.comwrote in message
news:uh****** ********@TK2MSF TNGP05.phx.gbl. ..
Ok, I found the WindowsPrincipa l class, and it's serializable. Does an
instance of this class guaranty the user is logged on a computer and
has been authenticated or is there a way to query the domain server if
the user is a rightful user? I mean, I must be sure the user making the
request (or query) is who he claims to be and is logged on the domain.
My app does not allow impersonnation, but I don't want anybody trying
to impersonnate someone on my network and claim being, let's say, the
president of the company and start making anything he wants with the
remote objects... you know what I mean? I need a way to secure things
so only an authenticated user or a user I can authenticate can have
access to the objects the service is providing. And I definitly need to
know the domain groups this user belongs to...

Thanks

ThunderMus ic

"ThunderMusi c" <No************ *************@N oSpAm.comwrote in
message news:eR******** ******@TK2MSFTN GP04.phx.gbl...
Hi,
>
I have to develop an application that will consist of a service and a
windows forms application... the service could be on a distant server
but I need to authenticate the user as being part of the same domain.
so when the application starts, I can send something to the remote
service and query for some objects and the service can give me the
objects if I'm the right user (part of the right group). I don't want
to send username and password nor password hash over the network so if
there is a better way (just like SQL server does or many other apps),
I would like to know it (maybe if you have a link)
>
Thanks
>
ThunderMusi c
>

[Robert Ginsburg]

You may want to investigate the MSDN sample about using SSPI with remoting,
it should do exactly what you are wanting to do
http://msdn.microsoft.com/webservice...ml/remsspi.asp

-Robert
"ThunderMus ic" <No************ *************@N oSpAm.comwrote in message
news:eR******** ******@TK2MSFTN GP04.phx.gbl...

Hi,

I have to develop an application that will consist of a service and a
windows forms application... the service could be on a distant server but
I need to authenticate the user as being part of the same domain. so when
the application starts, I can send something to the remote service and
query for some objects and the service can give me the objects if I'm the
right user (part of the right group). I don't want to send username and
password nor password hash over the network so if there is a better way
(just like SQL server does or many other apps), I would like to know it
(maybe if you have a link)

Thanks

ThunderMusic