Question

I need to write a program used internally where different users will have different abilities within the program.

Rather than making users have a new username and password, how do I tie into an existing domain server’s login system?

Assume .NET (C#, VB, ASP, etc)

-Adam

Answer 1

For WinForms, use System.Threading.Thread.CurrentPrincipal with the IsInRole() method to check which groups they are a member of. You do need to set the principal policy of the AppDomain to WindowsPrincipal first.

Use this to get the current user name:

private string getWindowsUsername() {     AppDomain.CurrentDomain.SetPrincipalPolicy(PrincipalPolicy.WindowsPrincipal);     return Thread.CurrentPrincipal.Identity.Name; } 

And then something like this to check a role:

if (Thread.CurrentPrincipal.IsInRole('Domain Users') == true) {} 

In ASP.NET, the thread will belong to IIS, so instead you should

1. Set the virtual folder or website to require authentication
2. Get the user name supplied by the browser with Request.ServerVariables(‘LOGON_USER’)
3. Use the DirectorySearcher class to find the users groups