HTTP Digest Authentication against Windows account

Hi,

I have written support for HTTP Digest Authentication in my ASP.NET
application.

When I am authenticating against a custom user store, such as a
database, all is well. The way Digest works is a one-way hash so I
simply retrieve the password, hash it, and compare the result against
what has come in on the Authorization header.

I want to be able to support authentication against Windows accounts
as well.

Unfortunately, I cannot see how I can achieve this. Here is my
thinking at present:

1) I don't want to use the built-in IIS Windows Auth functionality
(because it uses a proprietary NTLM Auth scheme, not Digest)
2) I cannot directly obtain the password of a user account from
Windows (this is entirely sensible, of course, to avoid a nasty
security hole).
3) I don't want to use HTTP Basic Auth because of it's vulnerability
to sniffers.

My question is this: Is there any way of programmatically getting
Windows to provide a Digest hash of a user password for me to compare
with the Authorization header?

Regards,
Alan Dean
http://thoughtpad.net/alan-dean
http://simplewebservices.org

.

Relevant Pages

  • Re: Cant get advanced digest authentication working
    ... is the server a member of Windows 2003 domain? ... Windows 2003 domain supports Advanced Digest authentication because only ... Microsoft Online Community Support ...
    (microsoft.public.inetserver.iis.security)
  • Re: help :Basic Digest vs Windows integrated ???
    ... does anyone can explain me clearling the real different between Windows ... integrated authentication and Basic Digest? ... Basic and Digest are different. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Digest authentication for Windows domain servers - Active directory
    ... Our production apps running on Windows 2003 Server and most of our ... Applications are authenticated agains Active Directory. ... at Digest requires a Username and Password" ... Edit they need to provide the authentication information). ...
    (microsoft.public.inetserver.iis.security)
  • Re: ASP page will not load
    ... Did you try WINDOWS ... >I already tried basic and digest authentication, ... > authentication fails while logged onto my own domain ... >>> using ASP. ...
    (microsoft.public.inetserver.asp.general)
  • Re: HTTP Digest Authentication against Windows account
    ... Maybe this explains why I don't get a WWW-Authenticate Digest ... You don't get to get the hash directly in Windows. ... Co-author of "The .NET Developer's Guide to Directory Services Programming"http://www.directoryprogramming.net ...
    (microsoft.public.dotnet.framework.aspnet.security)