Question

I have an ASP.NET application running on IIS 7 and using Windows Authentication. For testing purposes each of our test users has 5 test accounts set up for them on the domain. They need multiple accounts because they need to test different roles within the application. Users are using IE7.

The options that I can see available for allowing the user to log into the application under the different accounts are:

1) Log off Windows and log back in as the required test account. (Not very practical for the user).

2) Get the user to right click on Internet Explorer and choose “Run as…”, then enter the credentials for the required test account. (Not very intuiative for the user. Also some features don’t work properly in IE7 when running like this, e.g. Bookmarks, Printers)

3) Use Firefox or Chrome. (Not an option unfortunately)

4) Don’t use Windows Authentication (Windows Authentication is a requirement)

5) Update IE Options to prevent it from auto logging into sites (this would work, but it would be an annoyance for the users as they use a lot of other sites that use Windows Authentication).

6) Find some way in IIS/ASP.NET of preventing IE from auto logging in? (I haven’t seen any way of doing this but would be interested to hear any suggestions).

Can anyone think of any better ways?

Thanks.

Answer 1

I believe #2 is your best base to build on.

As far as being intuitive to the user: How about a Windows Forms application that can launch under the various test accounts?

I was going to try to build a quick test app, but found this post, first:

http://fraserchapman.blogspot.com/2007/07/programmatic-runas-in-c.html

After a couple minutes, I got this to work:

using System;  
using System.Diagnostics;

namespace TestRunAs
{
    class Program
    {
        static void Main(string[] args)
        {
            RunAs("C:\\Program Files\\Internet Explorer\\iexplore.exe", "TestUser5", "TestUser5Password");
        }

        static void RunAs(string path, string username, string password)
        {
            var secureString = new System.Security.SecureString();
            foreach (char c in password)
            { secureString.AppendChar(c); }
            ProcessStartInfo myProcess = new ProcessStartInfo(path);
            myProcess.UserName = username;
            myProcess.Password = secureString;
            myProcess.UseShellExecute = false;
            Process.Start(myProcess);
        }
    }
}

The obvious downside: password is floating around inside your app, so I hope these “test accounts” are going to be deleted after your project is done.

Followup: I went poking around looking for info on SecureString. MSDN’s usage example is EXACTLY what you’re trying to do, just using NotePad instead:

http://msdn.microsoft.com/en-us/library/system.security.securestring.aspx