.NET Login Dialog Implementation

views:

146

answers:

.NET Login Dialog Implementation

I have implemented a LoginAccess class that prompts the user to enter their active directory username and password. Then I save the login data as an encrypted file. Every subsequent start of the application, the LoginAccess class will read the encrypted file and check against the active directory to see if the login information is still valid. If it is not, then it will prompt the user again. I have made it so that the reading of the encrypted file and displaying of the login dialog is done on a separate thread. A delegate is fired when the login process is complete.

The issue that I'm having is that I have a class that is used in multiple places. This class contains the call to the LoginAccess object. Every time I instantiate a new object there are multiple calls to the LoginAccess object and I get multiple dialogs appearing when it tries to prompt for a username and password.

Any suggestions on how to have only one dialog appear would be greatly appreciated.

+2 A:

It would probably make sense to read the password file and perform the AD login in the main thread of execution, since presumably the user can't do anything else until they are authenticated. This should also eliminate your problem with multiple dialog boxes.

ElectricDialect 2010-04-10 19:06:55

I want to be able to pop up the login screen and load the application since it takes a while to start it.

arc1880 2010-04-10 22:27:59

+1 A:

Requesting user password in unprotected applications is a very bad practice.

If you must request elevated privileges, use CredUIPromptForCredentials and don't save them.
If you must run under elevated privileges, use the manifest of the file to request elevated context.
If you must run under completely different credential, then you should not be an application to start with, you should be a service instead.

Remus Rusanu 2010-04-10 19:23:09

I need to be able to save the entered credentials into an encrypted file so that I don't need to prompt them every time they open up the application.

arc1880 2010-04-10 23:05:51

If you need another use credentials, then you need to be a service running under those credentials. If you need current user credentials, you already have them and never ever need to ask for the user password. There simply is no reason for doing what you're trying to do.

Remus Rusanu 2010-04-10 23:12:25

I need to get the users credentials to make web service calls. How would I be able to get these credentials without prompting the user for them?

arc1880 2010-04-10 23:16:08

The moment you say 'active directory username and password' that means NTLM/Kerberos. Web Services can perfectly well authenticate NTLM/Kerberos, both at HTTP/Rest level and /or at SOAP level. A web service call will authenticate *the user running the application*. If you have to ask for password, you're doing it wrong.

Remus Rusanu 2010-04-10 23:38:16

Understanding HTTP Authentication: http://msdn.microsoft.com/en-us/library/ms789031.aspx

Remus Rusanu 2010-04-10 23:41:53

With WCf all you have to do over the HTTP binding is to set the transport security credential type to HttpClientCredentialType.Windows: http://msdn.microsoft.com/en-us/library/system.servicemodel.httpclientcredentialtype.aspx

Remus Rusanu 2010-04-10 23:44:03

Thanks for your suggestions. I will look into how I can change this. I found this article as well http://support.microsoft.com/kb/813834. Is this valid?

arc1880 2010-04-11 00:15:48

Yes, the KB 813834 is about exactly this topic.

Remus Rusanu 2010-04-11 00:25:52

Using integrated windows authentication is far more secure than say Basic authentication correct?

arc1880 2010-04-11 00:44:51

Yes. Basic basically passes the password in clear text.

Remus Rusanu 2010-04-11 01:03:27

ansaurus

tags:

views:

answers:

.NET Login Dialog Implementation

related questions