Security :: Override Windows Authentication Using Global.asax?
Jun 29, 2010
Here's my environment,Win2003 Standard SP2, IIS 6.0, MOSS 2007, .NET 2.0.50727
IIS website uses MOSS 2007 "Team Site" template and has only IWA enabled. Web.config has Windows auth w/ Impersonation:
<authentication mode="Windows" />
<identity impersonate="true" />[code]...
I'm using the KerbS4U extension to create a new WindowsIdentity which is then used to create a WindowsPrincipal for the new/overriding user:[Code]....
These succeed and I set the new principal to HttpContext.Current.User & Thread.CurrentPrincipal without errors. I've defined both Application_AuthenticateRequest() and Application_PostAuthenticateRequest() functions in global.asax. These show the "new" Identity
in the HttpContext.Current.User & Thread.CurrentPrincipal, but the "Welcome <DOMAINusername>" in the upper-right menu of the default.aspx homepage itself still shows the name from the initial IWA!
I was able to get the "Welcome <name>" to reflect the new user only when using GenericIdentity and GenericPrincipal, but this is a problem as I need to use impersonation to backend services (which can be done using constrained delegation using KerbS4U).
View 2 Replies
Similar Messages:
Oct 19, 2010
am currently working on a web application, whereby I want to add code to the Application_BeginRequest method of the Global.asax file, without adding code to the Global.asax file, which sounds a little crazy, let me explain a bit more.If anyone has ever developed in sitecore before, they would have seen that the Global.asax file has empty methods, however it has 'using Sitecore;' and the global.asax file provided does not inherit from System.Web.HttpApplication.
View 1 Replies
Dec 15, 2010
I have an asp.net 4.0 application that is using forms authentication set to a timeout at 45 minutes. I would like to redirect the user to a timeout page when the session has expired. Can anyone tell me how to do this? I am running .net 4.0.
web.config has:
<authentication mode="Forms">
<forms name=".ASPXAUTH" loginUrl="~/Login.aspx"
defaultUrl="~/Default.aspx" protection="All" timeout="45"
requireSSL="false">
</forms>
</authentication>
Global.asax.cs file has:
void Session_End(object sender, EventArgs e)
{
Response.Redirect("~/Timeout.aspx");
}
View 2 Replies
Jun 3, 2010
I have the same issue, I have added the On before the Application start, or Session Start and it is still not working.Application_OnStart or Application_Start is not firingSession_OnStart or Session_Start is not firing..Note that in my development environment it is firing (both of the names).When I am adding the Global.asax file, there is only one file (no .cs file). And when I am publishing the project, I am not getting the Global.asax file, I am getting a xxxxGlobal.asax.dll file on my bin folder...
View 1 Replies
Dec 6, 2010
I have a custom provider for authenticaiton that is HTTP Module-based. IIS authentication and web.config authentication is configure to 'None' and allow anonymous. When I probe for User.Identity.Name in Session_Start, it is empty. However User.Identity.Name works elswhere in the application as expected (returns the current user id). Is it possibly during Session_Start no authentication request has been issued, therefore there is no principal at this moment?
View 1 Replies
Jun 1, 2010
In the website we have several folders, some folders are accessible by anonymous users, others are accessible by members only, some by administrators or a both administrators and members can view this folder. Each folder contains some forms; these forms are based on the role as well. We'd like to add "user.identity" as to authenticate the user based on the user_id from table websit_ users.
However we are not sure , wither we need to specify each and every form, folder or this will be done automatically once authentication is applied. And where do we put the user.identity and what is the exact format of it. Do we include it in our Global.asax after the authentication part?! This is the code in global.asax:
[Code]....
View 1 Replies
Feb 11, 2011
I have (pretty much) the following code in my protected void Application_Error(object sender, EventArgs e) method in Global.asax....
Exception ex = Server.GetLastError();
if (ex is
System.Security.SecurityException)
Response.Redirect("Logon.aspx");
else
Response.Redirect("ErrorPage.aspx");
If I navigate to a page before I log on the exception is caught and I am redirected to Login.aspx as I would expect. However, this is only working when debugging using VS on my local machine.When uploaded to the live environment, the exception is not caught and the user is presented with "Security Exception - Request for principal permission failed."
View 1 Replies
Jan 3, 2010
i want to display current loged in username by global.asax
View 6 Replies
Feb 8, 2011
I know there is a couple answered questions on here regarding "request scoped" globals, but I want to nit-pick on something specifically and maybe squeeze some extra enlightenment out of one or two of you.I have an ASP.NET C# Website and a static Dictionary of objects (loaded from DB once on Application start). Each page request will need to do a lookup in the Dictionary (based on a key derived from the request url/etc) and get the appropriate object.The issue is I'm trying to maximize efficiency by reducing the lookups to the Dictionary per Request. Doing just a single lookup within a Page itself is easy enough and I can pass the object to sub controls, etc too.. but global.asax is separate from the Page and it also needs to use the object (in Application_BeginRequest and Session_Start).
So is doing a Dictionary lookup once in Application_BeginRequest, once (when necessary) in Session_Start and once in the Page negligible speed wise, even if there are many requests coming in every second?I would like it if I could just have a Request scoped global variable that I can easily call upon.. the only one I see available though is HttpContext.Current.Items and that is a Dictionary itself.Am I beingridiculously nit-picky with my concern over efficiency? or will these milliseconds (nanoseconds?) get me in the long run when more and more requests are being made?
PS. I currently only have around 100 objects in the Dictionary although this may increase in the future.
View 2 Replies
Jan 4, 2011
What's the difference between Basic Authentication and Integrated Windows Authentication in IIS?
View 3 Replies
Mar 10, 2010
I set authentication mode to Windows in the web.config and I enable Windows Authentication and disable the Anonymous Authentication in IIS 7 on win 7, but HttpContext.Current.User is always null.It works fine when I host the web app in IIS 6.0.
View 1 Replies
Dec 30, 2010
I have been trying to avoid the windows login userid and password window when I use the Windows Authentication mode for a web site. I need to capture the the windows logon user name without prompting for the user id and password and display that on the web site. I had tried almost everything... changed authentication,security setups on IE and IIS etc... still not being able to avoid the window...
View 1 Replies
Sep 3, 2010
What do I need to do in order to change an application from Forms Authentication to windows authentication?
View 2 Replies
Sep 8, 2010
We have a working version of application (Intranet) with uses Windows Authentication deployed in Windows 2003. The application uses HttpContext.Current.User.Identity.Name to get the logged-in user. Here impersonate is turned off.Right now, we are move to Windows 2008 RC2 where this Windows Authentication problem arised. I have Digest Authentication and Windows Authentication enabled. And also I have enabled Anonymous Authentication enabled to avoid the Login dialog of IIS in the end-user IE. Now I am getting HttpContext.Current.User.Identity.Name as Empty. When I impersonate using username and password, I am used to login using that user but all the users uses the same user to login.Does any has solution for this?Deployment Server - Windows 2008 RC2 (IIS 7.5)Development - Windows 7 (IIS 7.5)I am new to IIS 7.5. Please give me a solution
View 3 Replies
Sep 3, 2010
I am developing one intranet website. Being an intranet application, one of the requirement is to have a single sign on feature.
It means that the windows PC username (i.e the "ctrl + alt + delete" username) is going to be the username for the system.
How do i fetch that username?
I tried the following two ways which are working in debug mode but not on live site.
System.Security.Principal.IPrincipal user = System.Web.HttpContext.Current.User;
Response.Write(user.Identity.Name);
&
Response.Write(Request.ServerVariables["AUTH_USER"].ToString());
Both the above method works when i run the page from visual studio.
However when i run the page from IIS or any other server, it gives me a blank value
View 12 Replies
Dec 15, 2010
I have to invoke SSIS packages from web service in the most secure way. I think that windows authentication will be secure but i am not sure. I do not have much knowledge about how to achieve this and the information on the internet is very distributed.
View 1 Replies
Apr 6, 2010
We use Sharepoint to control our websites. We build the sites, then load them into the sharepoint server. My question is if I use windows authentication, how can I get my role security in my web config file to coencide with the asp.net controls that use the Forms authentication. Is there a differenence? Our security uses a session variable for security but there is no where to set up their permissions except in active directory. I hope this makes sense because I would like to implement the LoginView with Role groups but how can I give them the role="administrator"? Do I have to go into active directory and give them these permissions(would take awhile due to the size of the company)? Or do I have to set up priveladges in the web.config file for each user(difficult I think)?
View 5 Replies
Aug 18, 2010
I'm writing a simple Intranet application using windows authentication. I want to restrict access to Safe/UCantSeeMe.aspx. I am aware of the AuthorizeAttribute, but this only works on methods. I also found a good post on doing this with the MVC pattern, but I'm not using MVC. This can be done with roles in forms based security. I read on MSDN that using windows based security means roles are based on groups, but it doesn't go into any detail. how can I restrict access to Safe/UCantSeeMe.aspx?
View 1 Replies
Nov 22, 2010
I am trying to get the windows authentication for intranet design Codes return userid of my system but when I try the same fron other system, there too they return only my system's Id.
View 4 Replies
Jul 30, 2010
I want to know if this kind of authentication is possible.
We have an Active Directory account and that account we are using to log in to windows. I have a simple system that needs authentication using the IIS log in box (i dont know what do you call this but what I know is it only comes out when Anonymous user is unchecked in the IIS configuration.) Now, I want this box to appear before my page and the user will be authenticated and be compare to the user who logged in to the windows. If the user who have been authenticated is the same as the user who logged in to the windwos then we will let him in if not he must be denied in accessing the page.
The first problem I have in my mind is how to code it in asp.net to make an authentication when he will try to access my page.
Second is, let us say we have succeeded to show the authentication box, how can I get the username from the log in box and compare it to the user who logged on in windows. Of course we can get the user id of the logged in user from the windows using User.Identity.Name but how about the username from the log in box.
Note: I will not use log in forms even using https. Just the log in provided by the IIS according to the configuration.
View 1 Replies
Jun 3, 2010
What I want to do is, if userA access the website, then the website will use userA's token to access the SQL server. Site is an intranet site.In web.config,I have
<authentication mode="Windows"/>
<identity impersonate="true"/>
Connection string:Data Source=sql;Initial Catalog=xxxxxx;Integrated Security=SSPI;persist security info=False;
IIS:Annoymous login is disabled, Windows authenication is enabled.
SQL server:userA is added as a user to the database.
IIS and SQL server are on different server. Running as userA on another computer, I try to access the website. The website log told me the website was trying to login to the SQL server with NT AuthorityAnnoymous despite I specified to use integrated security and Annoymous login is disabled in IIS.
View 4 Replies
Apr 18, 2010
Form / Windows authentication?
View 3 Replies
Mar 24, 2010
I have an application that ran fine on a Win 2003 box using windows authentication. After installing the app on a 32-bit Windows Server 2008 box the users are now prompted for domain credentials every time they call the site. I went into IIS manager for IIS7 and disabled anonymous authentication and enabled windows authentication. What do I need to do here for the user to not be prompted for the credentials?
View 5 Replies
Dec 21, 2010
I am developing one portal in asp.net. Im using windows authentication. In our domain, we are give 6 digit number as username. Based on the 6 digit number windows will display the user name. Can I got the user name from asp.net? Im using asp.net with C#.
When I trying with,
WindowsIdentity.GetCurrent().Name - it will return "DomainName123456". Instead of this 6digit number I need the user name. The user name is displaying in start menu.
View 5 Replies
Mar 11, 2010
What's happening is when windows authentication/authorization fails the user get's a login prompt in IE6, IE7 and FireFox. Only when user clicks Cancel button in login prompt they are getting to 401 error page. What I am trying to achieve is to automatically redirect the user to a custom error page when getting 401 error instead of getting login prompt. Is this possible to suppress the login prompt in this scenario or is it this way by design?Here is my setup:I have windows integrated authentication configured in asp.net 2.0 web app.
[Code]....
In IIS I have website Directory Security configured to use Integrated Windows Authentication and disabled Anonymous Authentication
View 3 Replies
