single web app for both external users and domain users

[bitshift]

Ive been asked to allow internal (domain authenticated) users to get in to
my asp.net web application, while everyone else should use the login form.
One way ive seen others doing this, is to configure the application in IIS
to use windows authentication, uncheck anonymous, so as to have the browser
pass in the User.Identity value.

Then, when when a visotor hits the site, I can check if we have a domain
user with the User.Identity, and automatically log them in using a common
login name that is setup in the database. If the user.Identity is empty,
then force them to login as usual.

Sound reasonable ?

 

[bruce barker]

its much tricker than this. if you turn off anonymous, no one can access
the site with a successful domain login.

for the browser to send credentials, the server must send a 401 (access
denied). the browser then send some credentials. the server will return
another 401 if invalid, so the user can try again.

if you turn on anonymous, then iis never sends a 401 and the browser
will never send the user credentials.

the easiest solution is if the users ipaddress is internal, send a 401,
if not redirect to forms login.

-- bruce (sqlwork.com)