Question

I have a single sign-on widget that authenticates people against our AD. We also have employee kiosks, machines accessed with a generic user account. That generic user account cannot be used as part of the single sign on. Meaning that those users must sign in with their real active directory accounts. The problem is those generic accounts do not belong to any roles. So I have to do that authentication in my code.

The app runs in Windows Authentication.

Is there any way to force certain users to Windows Authenticate from code? I do most of my custom authentication in global.asax..

Answer 1

I used:

 <authorization>
    <denyRoles="RoleExcludeFromSSO">
 </authorization>

This way users from that role always have to enter their credentials.