.NET HttpModule & NTLM Integrated Authentication

From: Rob Mayo (NOSPAM_at_NOSPAM.COM)
Date: 01/24/04

  • Next message: Edgar Sánchez: "Where to store your salt" 
    Date: Fri, 23 Jan 2004 18:45:07 -0500

    What I'm trying to do is Create an ASP.Net app that has both
    Windows-authenticated users and Anonymous users. The idea is this:

    When authenticated users attempt to access the site, their credentials are
    passed to the Request, and I use the DOMAIN\USER value via the AUTH_USER
    server variable to access their accounts. These people would never have to
    log in to the app, only their machines on the network.

    When anonymous users attempt to access the site, they are redirected to a
    login page, rather than getting the Challenge dialog. Their login is
    verified against a database and I alter the Current User with a
    GenericPrincipal object.

    I tried enabling 'Allow Anonymous Access' in IIS and producing the challenge
    myself with a custom HttpModule, but was unable to make the challenge
    myself.

    Then I tried DISabling anonymous access and IIS provided the challenge and
    the 401 response before it even got to my custom HttpModule.

    Is there ANY way to acheive what I'm trying to do? Is there some way I can
    intercept a request before IIS issues a challenge and issue the challenge
    myself?

  • Next message: Edgar Sánchez: "Where to store your salt"

    Relevant Pages

    • .NET HttpModule & NTLM Integrated Authentication
      ... What I'm trying to do is Create an ASP.Net app that has both ... Windows-authenticated users and Anonymous users. ... I tried enabling 'Allow Anonymous Access' in IIS and producing the challenge ... the 401 response before it even got to my custom HttpModule. ...
      (microsoft.public.dotnet.security)
    • .NET HttpModule & NTLM Integrated Authentication
      ... What I'm trying to do is Create an ASP.Net app that has both ... Windows-authenticated users and Anonymous users. ... I tried enabling 'Allow Anonymous Access' in IIS and producing the challenge ... the 401 response before it even got to my custom HttpModule. ...
      (microsoft.public.inetserver.iis.security)
    • Re: .NET HttpModule & NTLM Integrated Authentication
      ... One of the security design considerations to take into account, ... (remember that ASP.NET is running over IIS, ... > When anonymous users attempt to access the site, they are redirected to a> login page, rather than getting the Challenge dialog. ...
      (microsoft.public.dotnet.security)
    • Re: .NET HttpModule & NTLM Integrated Authentication
      ... One of the security design considerations to take into account, ... (remember that ASP.NET is running over IIS, ... > When anonymous users attempt to access the site, they are redirected to a> login page, rather than getting the Challenge dialog. ...
      (microsoft.public.inetserver.iis.security)
    • Re: .NET HttpModule & NTLM Integrated Authentication
      ... One of the security design considerations to take into account, ... (remember that ASP.NET is running over IIS, ... > When anonymous users attempt to access the site, they are redirected to a> login page, rather than getting the Challenge dialog. ...
      (microsoft.public.dotnet.framework.aspnet.security)