Question

This will probably turn out to be a doozie.

I’m developing an application in ASP.NET to be put on our company’s intranet site. I’ve been handed a specification in regards to security and have no idea how to do it.

First part: The application is to use Windows Authentication. This part seems easy enough; I opened IIS in Administrative Tools, right clicked the node of my website, properties and checked ‘Integrate Windows Authentication’. However, I have no idea how I will govern which people have access to my site. I’m thinking this should be taken care of at the database level. This is Q#1

Second part — I have to implement a process for the following scenario: User ‘Jane’ can log in to our network, but does not have rights to my application. User ‘Bob’ does have rights to use my application. Bob needs to be able to sit at Jane’s computer (under her network account), but be able to enter his credentials into my application and use it (even though Jane is logged into the local machine and network). This is Q#2

Any help, general direction, or advice would be appreciated. The winning lottery numbers would be appreciated even more.

Thanks,

Jason

Answer 1

You’re looking for Windows Authentication and Authorization in ASP.NET

• How To Use Windows Auth in ASP.NET
• Authentication/Authorization Explained
• How To Implement Windows Auth in ASP.NET

Part 2…you’re right, that’s tough. You’ll need to roll your own custom security provider.
You’ll have a login page, then check that against Active Directory yourself. From MSDN

ASP.NET also supports custom solutions
for using Windows authentication,
which bypasses IIS authentication. For
example, you can write a custom ISAPI
filter that checks the user’s
credentials against Active Directory.
With this approach you must manually
create a WindowsPrincipal object.