Intranet Active Directory Auth with VB.NET

Question

Hi,

I'm developing an intranet web app and I'm learning how to hook VB into the Active Directory. We're going to be doing some location specific permissions, and my boss wants (if possible) me to hook into the Active Directory to get the users location.

I think that all I need to do is get the user name, but I'm not sure what is the best way to do that. We're a Microsoft only shop, so IE and IIS are the order of the day. To access the intranet you have to log on to the computer using our domain, so that's one level of security, but then I need to authenticate and make sure that user has permissions to make the changes. I'm thinking we'll either have a modifier (if there's not one already) in the AD info, or keep a permissions table in a database, but the former is probably preferred.

I know that IIS has a feature that allows/requires authentication but I'm not exactly sure how that's supposed to work.

So what's the best/easiest/somewhat(most?) secure way to get the users credentials? I could always do a login page but it would be much nicer if I could just get their AD credentials in the background.

Thanks!

Answer 1

IIS can be configured to use Integrated Authentication which will give you access to the samaccountname (pre-Windows 2000 logon) of the user. With that you can do an LDAP query against AD and check group membership. If the user is a member of the CanModifyStuffGroup (that you have created within AD and added users to) then let them make changes, otherwise give them the read-only version - or whatever.

Answer 2

you need to disable anonymous auth for your IIS site and enable windows-auth instead.

now go to your web.config and change the following

<authentication mode="Windows"> 
...
</authentication>

see http://msdn.microsoft.com/en-au/library/532aee0e(v=VS.80).aspx

&

if neccesary

<identity impersonate="true" />

see http://msdn.microsoft.com/en-us/library/aa292118(VS.71).aspx

now you should be able to get the current user with

HttpContext.Current.User.Identity.Name

to check if the user is in a specific group you can use

HttpContext.Current.User.IsInRole("YourActiveDirectoryGroup")