Re: both Windows and Custom Authentication for Web Services

I'd use two different WebSites/VDirs, one for internal, the other for
external.
However, if that presents a problem, then try this approach:

Assuming you know how to detect an internal access by IPAddress, check if
the request is authenticated. If not, send a 401 which will force IIS to
dictate its authentication modes which will include Integrated Auth (NTLM or
Negotiate, NTLM). That way you force the internal user to use Integrated
Auth and force the external user to perform the custom authentication
process (which I assume you have).

Tiago Halm

"Daniel P." <DanielP@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C125EA69-4190-4DEE-BE0F-BB2179FC4BC6@xxxxxxxxxxxxxxxx
I expose a collection of services using Win 2003 server and web services. I
need to support both Windows authentication for internal user and custom
for
outside users.

I configure IIS to use both Anonymous access and Integrated Windows
authentication.

WSLogon logon = new WSLogon();
logon.PreAuthenticate = true;
logon.Credentials = CredentialCache.DefaultCredentials;

but when I get on the other side, in the WS class,

this.User.Identity.IsAuthenticated

is False.

The only time it is true is when only Integrated Windows authentication is
checked in the ISS settings for my WS app.

Is there a way I can support both Win auth and Custom auth on the same WS
application?

I know that I can create two identical WS apps one supporting Win Auth and
the other custom (Anonymous) but that will complicate things since the
config
file for the internal and external clients will point to different URLs.




.

Relevant Pages

  • RE: Membership Provider Woes
    ... in forms authentication context. ... how do I actually store the custom information? ... limited by the natural of cookie. ... Doens't the membership provider set a forms auth cookie for me ...
    (microsoft.public.dotnet.framework.aspnet)
  • Forms authentication in a subfolder problem, please help
    ... When I create forms authentication at root level it works but when I move my ... <!-- CUSTOM ERROR MESSAGES ... Application-level tracing enables trace log output for every page ... private void Page_Load ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Authentication? Forms without Anynymous access
    ... No, forms auth is secure, as long as the authentication mechanism you ... Windows auth happens at the IIS ...
    (microsoft.public.dotnet.security)
  • Re: * * * C# Application and Database Security Model * * *
    ... I've noticded that your main concern here is to provide security ... If you're going to do authentication and authorization against windows ... authenticate user against custom security account database and authroize ... Microsoft MSDN Online Support Lead ...
    (microsoft.public.dotnet.languages.csharp)
  • Runtime error when customErrors are Off
    ... "On" Always display custom messages. ... This section sets the authentication policies of the application. ... Application-level tracing enables trace log output for every page ... <!-- SESSION STATE SETTINGS ...
    (microsoft.public.dotnet.framework.aspnet)