ASP.NET MVC Windows Authentication Question

Question

Hello,

I've built a custom login system for my asp.net mvc 1.0 web application as I store large amounts of user data for each user (I decided against trying to add custom tables for the windows authentication due to this). The login system basically uses SQL Server (2005 or 2008) and my own database and table structure which is pretty standard. A users table with an unique id, username and hashed password which is linked to my other tables of user related data.

My question is, how can I tie my system to use Windows Authentication logins. I would like to allow the administrator to for a user (as defined in my system) select a Windows Authentication login and perhaps add a value to something in my custom table that I can use to authenticate them?

The questions probably phrased wrong and I might have misunderstood how Windows Authentication works but I would like to offer the option in my web application.

Phil

Answer 1

If I am understanding your question correctly you want to add some other data linked to a Windows Authenticated user name?

If so you will need to store the username and this custom information in a new table. The windows authentication data exists in Active Directory so you could look there to get a list of users. You will not get any custom information added to AD automatically when Windows authenticates the user. If you want any custom info you will need to add a custom lookup into AD for it or just lookup your custom data in your database depending on where you decide to store the information.

Pretty much all you get with the Windows Authentication is the user's username and the ability to check the roles (AD groups) associated with that user. Anything beyond that you will need to manually code up.

I recently asked about implementing customization beyond the built in security in MVC and came up with a solution on my own. Maybe there is some tidbits that might help you answer your question:

http://stackoverflow.com/questions/1151450/how-to-implement-authorization-checks-in-asp-net-mvc-based-on-session-data

Answer 2

If you have Windows Auth enabled on your site then you should be able to use User.Identity.Name to get their NT/Active Directory user name of the currently logged in user, and match that to a column in your users table.

Answer 3

Here's how we've done it for a hybrid forms/windows authentication app:-

public class MyBaseController
{
  protected override void OnAuthorization( AuthorizationContext authContext )
  {
    if
    (
      !User.Identity.IsAuthenticated &&
      Request.LogonUserIdentity != null &&
      Request.LogonUserIdentity.IsAuthenticated
    )
    {
      String logonUserIdentity = Request.LogonUserIdentity.Name;
      if ( !String.IsNullOrEmpty(logonUserIdentity) )
      {
        User loginUser =
          Context.Users.FirstOrDefault(
            x => x.UserIdentity == logonUserIdentity);
        if ( loginUser != null )
          FormsAuthentication.SetAuthCookie(
            loginUser.LoginName,createPersistentCookie);
    }
  }

There's some encapsulation that I've taken out for the sake of compactness.