Question

Please assume there are two servers:

• Server-A: Windows 2012, IIS8, ASP.NET 4.5
• Server-B: Windows 2012, IIS8, ASP.NET 4.5, Active Directory

The two servers are owned and managed by different organisations, and Active Directory on Server-B has no remit nor involvement with Server-A.

Based on this, is it possible to use Windows Authentication on Server-A to authenticate a user accessing Server-B? I would assume not, but obviously aren’t completely sure.

I have managed to write code on Server-B to read attributes (e.g. employeeID) for the currently authenticated user, but need to pass them to Server-A for processing (this might eventually act as a single-sign-on mechanism). Unless there are better ways of course which you might want to share??

Answer 1

I achieved this in the following manner. There may be better methods but this one is as secure as I can get it:

1. User logs into Server B via Active Directory
2. User access an ‘authentication’ page hosted on Server B
3. The page looks up their AD employeeID and encrypts it in a cookie
4. The user is transfer to the web app on Server A
5. Web app on Server A sees the encrypted cookie and decrypts it, checking that the previous page was located on the customers IP address
6. Web app logs the user in using the employeeID from the encrypted cookie

An interface has been created on Server B so that when a employeeID value gets updated, this change is mirrored onto Server A so that the employeeID values stay synchronised.