Security for ASP.NET application running on intranet / VPN

Question

Hi,

I have an ASP.NET app that sits on our intranet, using the WindowsIdentity to identify the user:

WindowsIdentity wi = HttpContext.Current.User.Identity as WindowsIdentity;

if (wi == null || wi.Name == null)
{
    noAccess("No WindowsIdentity");
    return;
}

string username = wi.Name;
    if (username.Contains("\\"))
        username = username.Substring(username.LastIndexOf("\\") + 1);

This works fine on our Intranet. However, when users from other offices (separate network, with firewall open) they get a password request input box.

Why are they getting the password dialogue?

What is the recommended way identify users of the app? I want to avoid using password, but windows identities. Anyone attempting to access the application is inside a trusted network.

Thanks a lot for any help

EDIT: The other users are on a separate network, with access controlled by firewalls. IIS is running with Integrated Windows Authentication

Ryan

Answer 1

Talk to your admins. Could be the firewall blockes something. You should NOT get a password request just for a WAN split between. Not if everyone is on one domain.