Re: Problem establishing SSL connection in code-behind

If you just want to use the AD membership provider for authentication, your
service account only needs read access to AD. The highly privileged account
is needed if you want to use any of the provisioning features of the
provider for creating users and such. It is possible to allow the process
account to make the connection (assuming you have a domain member web server
and are running the app pool under a domain account or network service).
I'd seriously look at that.

It is also possible to authenticate users against AD directly without using
the membership provider and without using a service account at all. You can
just call the LogonUser API for instance. Doing something like this would
be much cleaner than what you are trying to do.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--

Thank you for the clarification. I actually did want to directly try
Active Directory(AD) authentication. But from the documentation I
read, it looks like that we need to put into web.config the username/
password of an administrator of the target domain.

Although such credential info can be encrypted in web.config, I balk
at asking for such info from our client. That's why we would like to
go the roundabout way.

I will copy-paste the details of the logon audit on Monday.


.

Relevant Pages

  • Re: Integrated Windows Authentication Timeout?
    ... is the username of the user account that runs the service. ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... You might consider enabling protocol transition authentication since ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Integrated Windows Authentication Timeout?
    ... For the second search, if the user account has an SPN of HTTP/webserver, ... Joe Kaplan-MS MVP Directory Services Programming ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... You might consider enabling protocol transition authentication ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: WindowsTokenRoleProvider & Domain Groups
    ... as the auth store. ... If you do plan to use the AD membership provider, ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... The only reason I'm using Windows Authentication ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Why must credentials be explictly given when user is already l
    ... NETWORK SERVICE is a built-in account introduced as of WinXP that it used to ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... AD, authentication is not required by default, so if you accidentally ...
    (microsoft.public.dotnet.security)
  • Re: Active Directory Membership Provider permission
    ... The AD membership provider plugs ... It sounds like he just wants the authentication part and doesn't need the ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... The current service account is a User account and the subject provider ...
    (microsoft.public.windows.server.active_directory)