Re: Urgent: Connecting to active directory using cached credentials

From: Scott Allen (bitmask_at_[nospam)
Date: 10/07/04 

Date: Thu, 07 Oct 2004 10:58:39 -0400

Hi Chris:

The problem you are probably facing is the one hop limit of NTLM
authentication. The user's credentials make one hop from the browser
to the web server, and the web server can use those credentials
impersonate the user on the web server. However, the server cannot use
those credentials to make a second hop to the AD controller.

One way around this is to move up one step from impersonation to
delegation.

See:
How To Configure an ASP.NET Application for a Delegation Scenario.
http://support.microsoft.com/default.aspx?scid=kb;en-us;810572

HTH 

--
Scott
http://www.OdeToCode.com/
On Wed, 6 Oct 2004 23:28:48 -0700, "Chris L" <ripandburn@hotmail.com>
wrote:
>Hello,
>
>   I'm hoping to find out if it is possible to connect 
>within an ASP.NET application to Active Directory with 
>the credentials of the person who accessed the ASP.NET 
>application via IIS, using windows integrated 
>authentication.
>
>I've tried using ADO, ADSI, and Directory Services, but I 
>have yet to find a way to connect to active directory 
>with the security token created by IIS, when the user 
>accesses the ASP.NET application with windows integrated 
>authentication.
>
>Being able to do this is a pretty urgent problem, so any 
>help anyone could provide would be extremely appreciated.
>
>Thank you!
>-Chris

Relevant Pages

  • Re: Problem establishing SSL connection in code-behind
    ... that isn't a double hop as you have plaintext credentials for the ... If the remote resource was a web app, ... If your goal of this set up is simply to use forms-based authentication to ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: IIS6 - Integrated Authentication Probs
    ... When you use Basic authentication, ... outlined in Chapter 5 of the IIS 6 Resource Kit: ... > b) - Despite the fact these credentials are being parsed, ... > Hence - this is a general problem with the way the web server is using my ...
    (microsoft.public.inetserver.iis.security)
  • Re: Windows authentication
    ... I did not realize that going through a browser on ... the same machine as the web server would introduce the double hop. ... > credentials will not hop to 2 different machines. ...
    (microsoft.public.dotnet.security)
  • Re: Anonymous and NTLM
    ... This is by design, browsers will always attempt to connect anonymously, and ... base on authentication challenge header receive from web server, ... > the lowest credentials needed to complete a given resource request. ...
    (microsoft.public.inetserver.iis.security)
  • IIS6 - Integrated Authentication Probs
    ... server to a UNC share on another server ... It seems that when I use "integrated authentication" that the credentials ... Hence - this is a general problem with the way the web server is using my ...
    (microsoft.public.inetserver.iis.security)