How would I authenticate against a local windows user on another machine in an ASP.NET application?

Question

In my ASP.NET application, I need to be able to authenticate/authorise against local Windows users/groups (ie. not Active Directory) on a different machine, as well as be able to change the passwords of said remote local Windows accounts.

Yes, I know Active Directory is built for this sort of thing, but unfortunately the higher ups have decreed it needs to be done this way (so authentication against users in a database is out as well).

I've tried using DirectoryEntry and WinNT like so:

DirectoryEntry user = new DirectoryEntry(String.Format("WinNT://{0}/{1},User",
           serverName, username), username, password, AuthenticationTypes.Secure)

but this results in an exception when you try to log in more than one user:

Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. Disconnect all previous connections to the server or shared resource and try again.

I've tried making sure my DirectoryEntries are used inside a using block, so they're disposed properly, but this doesn't seem to fix the issue. Plus, even if that did work it is possible that two users could hit that line of code concurrently and therefore try to create multiple connections, so it would be fragile anyway.

Is there a better way to authenticate against local Windows accounts on a remote machine, authorise against their groups, and change their passwords?

Thanks for your help in advance.

Answer 1

In my opinion you cannot do this from your ASP.Net script. Because from the server you need to know what all client machines will access your page and provide sufficient rights to the server to access the client to do this extra user authentication and password change. Also this is cumbersome. One solution is to use an activex control and write this logic (user authentication and password change) in that activex control and provide the activex control sufficient rights in the clients. It is a bit ugly but this is the only possible solution without ADS.