Form authentication via LogonUser does not pass credentials to ifr

From: Andrew van der Stock (Stock_at_discussions.microsoft.com)
Date: 07/22/04

  • Next message: Paolo: "GetEffectiveDateString is bugged?" 
    Date: Wed, 21 Jul 2004 17:23:01 -0700

    Hi there,

    we are trying to use a web form to authenticate users against Active Directory on .NET 1.1 running under Windows 2003.

    The authentication using LogonUser works just fine, and we can assert things like

    if ( Context.User.Identity.IsAuthenticated )
    { do stuff }

    on another page after returning from the logon page as defined in web.config. So far, so good.

    However, when we try to include an iframe, the credentials the user has signed in do not pass to the iframe. It might be easier to describe what I am trying to do, as there may be a better way.

    We are trying to allow Internet users to authenticate via SecurID to AD protected resources inside the client's network. We have tried various approaches, including RSA ClearTrust, but for various reasons, this didn't work. The network is like this:

    browser -> Internet -> Checkpoint -> ISA Server web publishing rule integrated with RSA SecurID (FP1) -> myADauth page -> iframe to resource

    We have modified the SecurID login pages on the ISA server to include a password, which is not used by SecurID authentication, but passes it on using a post to the logon page in my app after SecurID authentication. This works.

    Once the post has completed with a correct credential, we are authenticated, and the iframe attempts to load. However, the Sharepoint or OWA resource within the iframe presents a basic digest logon request.

    The iframe is using a URL that is also published by ISA web publishing rules, so essentially there is no reverse proxy issue. The only issue is that we cannot provide cross-site authentication, and we would like to.

    Any clues gratefully received,
    Andrew van der Stock

  • Next message: Paolo: "GetEffectiveDateString is bugged?"

    Relevant Pages

    • Re: Kerberos machine authentication - apparent authentication fail
      ... > until logon), the wireless connection can kick off when it is ready. ... > was confirmed in the server event logs with IAS (i set that up as the radius ... > as an ordinary user kicks in and takes over from the machine authentication. ... > while the network sorts itself out and a double click on a network link of ...
      (microsoft.public.windows.server.security)
    • Re: Kerberos machine authentication - apparent authentication fail
      ... as the case may be) which will delay authentication until ... I also have an Intel network adapter and WAP that does not have this> problem and even works well with 802.1X EAP-TLS for domain logon. ... In> most cases [ipsec a possible exception] kerberos authentication is not> needed to access domain resources as long as the client and server use a> common authentication method for lm/ntlm/ntlmv2. ... The main issue is to> NEVER include an ISP dns server in the preferred server list in the tcp/ip> properties or DHCP scope of any domain computer or any computer you want to> join to the domain in which case your computers may be trying to locate the> domain _srv records on the ISP dns server and fail. ...
      (microsoft.public.windows.server.security)
    • Re: Logon 529 Errors
      ... Authentication in SMTP virtual server. ... These are almost surely SMTP logon attempts, ... Caller User Name: DELLSERVER$ ...
      (microsoft.public.windows.server.sbs)
    • Re: Active Directory Logon to attribute
      ... have permission to access as you are denied to logon from this workstation... ... If accounts and machines are from abc.com they can logon to abc.com only. ... named xyz.org for the user authentication for internet. ...
      (microsoft.public.windows.server.active_directory)
    • Re: Kerberos machine authentication - apparent authentication fail
      ... until a user logon event. ... the Netdiag utility will show the Kerberos error in this scenario ... On these machines I ... me a plausible starting point to solve my Kerberos authentication problem. ...
      (microsoft.public.windows.server.security)