Re: WindowsTokenRoleProvider & Domain Groups

I wouldn't use the WTRP at all - it doesn't give you any advantages besides making it even more confusing at times...

Just use no role provider with Windows authentication and you can find a WindowsPrincipal sitting on Context.User which provides all the necessary functionality.

-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

I've been researching using Domain Groups within our application. I
found a code sample that I've been experimenting with, but need
confirmation on one behavioral thing that I've noticed.

My web.config contains the following:

<system.web>
<authentication mode="Windows" />
<roleManager enabled="true"
defaultProvider="AspNetWindowsTokenRoleProvider" />
</system.web>
The IIS vdir has anonymous access turned off and Integrated Windows
Authentication turned on.

In my web page, I execute:

string[] members = Roles.GetRolesForUser();

The returned members include domain global groups and builtin groups.
The list does not include Domain Local groups to which I belong.

Is this expected behavior (the lack of domain local groups) or am I
doing something incorrectly?



.

Relevant Pages

  • Re: How to change the scope of Security group from Global to Domain
    ... That's no longer true ... ... it hasn't been as of Windows 2000 in Native ... Domain Local groups may now be used to grant access to secured ...
    (microsoft.public.windows.server.active_directory)
  • Re: Win2K cant see domain local group of a NT 4 pdc
    ... Domain local groups are a group type that was new to a Windows 2000 Active ... Directory domain when in Native mode. ...
    (microsoft.public.windows.server.security)
  • Creating Login on SQL 2000 wont show domain local groups
    ... we do have a new infrastructure with windows 2000 and sql 2000. ... global groups and domain local groups to manage the users. ... I'm really wondering why I can't see the domain local groups? ... Did I forget to activate something in the sql 2000 box? ...
    (microsoft.public.sqlserver.security)
  • Re: WindowsTokenRoleProvider & Domain Groups
    ... Are those domain local groups that are local to the domain the web server is ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... Is this expected behavior or am I doing ...
    (microsoft.public.dotnet.framework.aspnet.security)