dynamic client authentication

A Happy New Year to all!

I built a corporate intranet site (ASP.NET, IIS 6.0, W2K3) that (until now)
was only used by domain users. The authentication mode was set to Integrated
Windows authentication, so clients could be easily identified
(Page.User.Identity / System.Security.Principal.WindowsIdentity ...).
Authentication btw is not the problem, but identification is, because every
user has its own personal profile stored in a database.

Now additional corporate users want to use the site, that do not have a
domain account. This new class of users can not be identified by their IP
addresses and the administration of individual server-local user accounts is
not wanted.

So I have to turn on "Anonymous" access. The problem is, if anonymous is
turned on, no NTLM handshake is done and therefore no "identity" is aquired
from the client - even if IWA is also checked.

How can it be achieved, that all existing and future domain users can use
the site as usual and only non-domain users must identify themselfs at a
custom page (without dismissing the browsers logon window and via a replaced
401 page because it is confusing)?

Clearly spoken, I want IIS to do IWA and if that fails, it should accept the
client as anonymous user instead of returning the 401 error that leads to the
browser logon process on the client.

Is there an "administrative" solution or do I have to write an ISAPI filter?
Is there any such ISAPI sample out there?

Thanks in advance!
.

Relevant Pages

  • RE: Windows Me/98 Client connecting to SQL W2k3
    ... because to simplify the connection problem it can also be ... On Wednesday I will be at the client site and I will check the MDAC and the ... SQL authentication we do not use. ... Only Windows Authentication. ...
    (microsoft.public.sqlserver.connect)
  • Re: Raising DFL to highest -
    ... Thanks you very much, Laura and Jorge. ... on NT4/IIS4 using the windows authentication? ... > using NTLMv2 authentication, and access to ADSI scripting functions. ... > that you'll need to move to 2K or XP on the client. ...
    (microsoft.public.windows.server.active_directory)
  • Cisco AP, PEAP, MS Windows2003 IAS
    ... We have configured a wireless network using PEAP, ... is the IAS server logs a authentication failure. ... Calling-Station-Identifier = Client MAC Address ... Proxy-Policy-Name = Use Windows authentication for all users ...
    (microsoft.public.internet.radius)
  • Re: 802.1x Authentication Prior to Windows Logon
    ... You seem to be confusing 802.1 authentication and domain logon. ... However what the client really wants is for the workstations to login to ... wireless network using 802.1x prior to the windows authentication. ...
    (microsoft.public.windows.server.networking)
  • Re: IIS Web Service 401 Error with Integrated Windows Authenticati
    ... webserver name since the problem happens when the authentication type is ... client programmatically. ... >> However, if the Integrated Windows Authentication is ticked, invoking the ... >> DownUnder. ...
    (microsoft.public.dotnet.framework.aspnet.security)