Passing AD authentication credentials via IE browser in C# Windows Form

Question

We have a Windows Form application which hosts an IE browser control. Our users run the application and open links to documents stored in MOSS. We are trying to set the application up to pass in credentials of a service account so that we can avoid giving all users access to the MOSS site. We have used code found here which seems to work fine if the user is not currently signed on to our domain. However the application will not seem to pass in the service account authentication for any user which is already authenticated to the domain. In this case it just seems to use the authenticated users credentials.

Does anyone know of how we can make this work?

Thanks!

Jeff

Answer 1

Would impersonation not help here? You can run that bit of code (the form) under the guise of the service account user you're talking about and the browser control should then run within the same context.

the following links might help;

http://msdn.microsoft.com/en-us/library/b80a7e92.aspx

http://www.buro9.com/blog/2006/10/06/impersonating-a-user-in-c/

Answer 2

My understanding is that the IE control in your application will automatically sign-in to the MOSS site, based on the credentials in the Windows session. You would rather it always used an account you specify, and coded into the application?

IE automaticlly signs in to domain sites using a type of Kerberos authentication (Windows Integrated Authentication)

Three suggestions;

• Do not use the MOSS site's WINS name but IP-address instead (may also work with DNS names e.g. not http://moss-server but http://moss-server.domain.com). This should cause IE to not automatically sign in to the site.
• Change the authentication model on the web-server to use Basic only (security warning - clear text password exchange)
• Disable the option for 'Enable Integrated Windows Authentication' in the web-browser. This will make accessing any sites in the domain a pain...

My recommendation is the 1st one. Use a different address to make IE think it is not accessing a trusted site and therefore not use integrated authentication.

All can be tested using IE outside of the application. Simple fire up IE and enter the address you are using to the MOSS site. If you are asked for a password, you have your solution.