Question

For a given application I have a .aspx login form backed by a C# code behind file.
In the code behind I am using the following “home grown” method:

private bool AuthenticateUser(String username, String password)
{
    bool validated = false;
    try
    {
        PrincipalContext pc = new PrincipalContext(ContextType.Domain, "domnet.domad.com", "dc=domnet,dc=domad,dc=com");
        IdentityType ADElement;
        UserPrincipal up;

        //Try first with no @DOM.COM - this should work for SamAccountName values:                 
        username = username.ToUpper().Replace("@DOM.COM", "");
        ADElement = IdentityType.SamAccountName;
        up = UserPrincipal.FindByIdentity(pc, ADElement, username);
        validated = pc.ValidateCredentials(username, password, ContextOptions.Negotiate);

        //If SamAccountName fails try UserPrincipalName with @DOM.COM
        if (!validated)
        {
            username = username + "@DOM.COM";
            ADElement = IdentityType.UserPrincipalName;
            up = UserPrincipal.FindByIdentity(pc, ADElement, username);
            validated = pc.ValidateCredentials(username, password, ContextOptions.Negotiate);
        }

        //Put username into session
        if (validated)
        {
            Session["Username"] = username.Replace("@DOM.COM", "");
        }
    }
    catch (Exception) //login failure...
    {
        validated = false;
    }

    return validated;
}

This works fine for the application but I have other applications that need authentication too.
I really don’t want to copy / paste the login files into ever application.

So my most basic question is what are my options to centralize the authentication code between applications?

In the future I will also be looking to:
Verify not only username/password but also AD group membership.
Once user is authenticated no more log in screens between apps. (SSO)

It seems to me I am not the first person to run into this problem.
I would prefer to use an out of the box solution vs. developing my own if possible.

Answer 1

You could:

• Enable Windows authentication in IIS and set your Web.Config to use Window authentication http://weblogs.asp.net/scottgu/archive/2006/07/12/Recipe_3A00_-Enabling-Windows-Authentication-within-an-Intranet-ASP.NET-Web-application.aspx
• Setup an ADFS claims authentication server and have all your applications use claims based authentication http://blogs.msdn.com/b/alextch/archive/2011/06/27/building-a-test-claims-aware-asp-net-application-and-integrating-it-with-adfs-2-0-security-token-service-sts.aspx
• Have one application that all others redirect to for authentication and set an encrypted cookie that the other applications can read to verify authentication Encrypt cookies in ASP.NET