how to tell why integrated windows authentication fails in asp.net

Question

In our asp.net intranet application we are using windows authentication to authenticate the users.

We have recently had a request to give the user a reason for why they cannot login. For example, tell the user they can't login because their password has expired vs they can't login because their account is locked out.

When an account is locked out or the password has expired, the user cannot log on to the application. IIS will deny the access and redirect the user to the Access Denied (401) page after 3 login attempts. As the username is not passed to web application when IIS authentication fails, we won’t be able to check if the account is locked out or the password has expired.

Any suggestions on how to get this information? Are we going to have to move to Forms authentication with an AD provider?

Answer 1

The simple solution to this is to move to forms authentication. But being that I know you did not want to hear that and it is not allowed or a viable solution your next option is to:

Look into System.DirectoryServices

Below I'm just pasting some quick code you can play with. Notice how to determine if a user is locked out or not. This is vb.net but can be easily changed to C#.

  Try
            Dim dirEntry As DirectoryEntry
                     dirEntry = New DirectoryEntry("LDAP://yourDomainInfoHere/OU=Users,OU=YourDomain,OU=YourOU,OU=CORP,DC=YourDC,DC=com", "ExecuateAsUser", "Password")

            Dim entries As DirectoryEntries = dirEntry.Children
            ' Set login name and full name. 
            Dim newUser As DirectoryEntry = entries.Add("CN=JONNY BOY", "User")

            newUser.Properties("sAMAccountName").Add("jboy")
            newUser.CommitChanges()
            newUser.Invoke("SetPassword", "hi2343145gfdtgwdt")
            Dim flags As Integer

            flags = CInt(newUser.Properties("userAccountControl").Value)

            'enable user below
            newUser.Properties("userAccountControl").Value = flags And Not &H2

            'disable user below
            newUser.Properties("userAccountControl").Value = flags Or &H1


            'lockout property
            Dim l As Long
            l = CType(newUser.Properties("lockoutTime").Value, Long)

            If l <> 0 Then
                'account is locked out

                'so how do we unlock it?
                'we unlock it by setting it to 0
                newUser.Properties("lockoutTime").Value = 0
            Else
                'account is 0 it is NOT locked out

            End If

            newUser.CommitChanges()

            Dim j As DirectoryEntry = entries.Find("CN=JONNY BOY", "User")
            j.Properties("mail").Value = "[email protected]"
            j.CommitChanges()
        Catch ex As Exception
            Throw ex
        End Try