Manual Windows Authentication

Question

I'm currently trying to figure out how to perform manual windows authentication in our ASP.NET Application. The problem is that we have an OData service running, and use FormsAuthentication to provide the generic login mechanism and allow the PUT & DELETE verbs for OData, including form redirects.

However, for some customers we have integrated Windows Authentication to allow smooth integration for their users with the active directory. The problem now is that we want to be able to switch authentication methods without breaking the Odata service, because we depend on it.

What we're trying to do is mimic the Windows Authentication mechanics using an IhttpModule. So far we're able to toggle the feature on & off, and we get the challenge when a request is made. What I don't know is how to use the received information from the browser to perform authentication against the active directory:

This is the code we use to extract the NTLM information from the current request:

/// <summary>
/// <para>Determines whether the current <see cref="HttpRequest"/> is a NTML challenge.</para>
/// </summary>
/// <param name="request">The <see cref="HttpRequest"/> to evaluate.</param>
/// <param name="header">The output header to authenticate.</param>
/// <returns>True if the current <see cref="HttpRequest"/> is considered a NTML challenge.</returns>
 protected bool IsNtlmChallenge(HttpRequest request, out string header)
 {
      const string headerName = @"Authorization";
      if (request.Headers.AllKeys.Contains(headerName))
      {
           header = request.Headers[headerName];
           return true;
      }

      header = string.Empty;
      return false;
 }

This allows us to extract the header from the request. What I need to know now is how I perform the authentication with this on the active directory.

This is the logic we use to extract the info:

// Check if we need to handle authentication through Windows authentication or not.
if (WindowsAuthentication)
{
    string encryptedHeader;

    // If this is a challenge from the client, perform the Windows Authentication using the 
    // information stored inside the header.
    if(IsNtlmChallenge(HttpContext.Current.Request, out encryptedHeader))
    {
         /* how to authenticate here with the encrypted header? */
    }

    HttpContext.Current.Response.AddHeader("WWW-Authenticate", "NTLM");
    HttpContext.Current.Response.StatusCode = 401;
    return;
}

Hope someone can provide the anwser that I need.

I doubt that it is possible to mix forms and windows authentication that way. For winauth you must enable it in IIS (because IIS is the one that will verify those credentials), and win-auth and forms-auth cannot work together in some IIS setups (IIS7+ integrated app pool, for example). In addition, there is only one auth mode that you can specify in web.config. While with classic app pool you may mix auth, but not on the same files/folders. If this is what you're running, enable win-auth on a specific folder/file/url-path (e.g. aspx handler), then use that handler to authenticate win/AD users. — , Jan 25 '12 at 23:43
Try this post: http://stackoverflow.com/questions/2539038/iis7-mixed-mode-authentication — Tjaart, Jan 26 '12 at 00:39
We're aware of using a secondary site, but this is to be a last resort. I'm really hoping that someone can come up with a solution to the problem first. — codingbunny, Jan 26 '12 at 08:12

score 0 · Accepted Answer · answered Jan 26 '12 at 15:38

Alright,

based upon the comments received on my question, i've come up with the following solution to bypass the problem that I have. I know it's not a clean solution, but at least it works for us.

Create a new Web Application that runs inside your application
This sub-application relies on Windows Authentication
- Disable Anonymous Authentication & Forms Authentication
Create a Login.aspx page that handles the Windows Authentication
We generate a cookie after the login and redirect to the original app
Original app recognizes the cookie and takes the user.

This requires that we generate the same keys for encryption & decryption for both applications. This can be set using the Machine Key Module in the IIS manager for your application. If the keys are not equal for both applications, the encode/decode process for the cookie will fail. We set them to auto-generate using SHA1, but the same keys for both applications.

Now we check the settings on the original login page, redirect to the sub-application's login page if Windows Authentication is required and perform the login there. Then we redirect back to the original login page and use the cookie to continue.

This results in a few redirects when making the initial login, but afterwards the application runs as smooth as ever.

Manual Windows Authentication

1 Answers1