single sign on - why not trust AD?

For intranet development.. is there anything terribly wrong with
authenticating users against AD groups to determine what pages, menus,
features they should be allowed to see and use?

Would there be any valid reason for asking users to re-enter there AD
user and PW for every intranet Application to confirm they are in the
AD Rather than just testing the security of the windows user with the
below code? Any benefit to carring around a cookie or Session with
something that is then used to confirm they were authenticated at some
point in the session? What the value of this beyond allowing one user
to authenticate in an intranet site while windows is authenticated as
another user? And is there no risk to session or cookie that could be
easily read and replicated to fool the site?

What the best and/or most common practice for intranet website
security?


If (Page.User.IsInRole("XXX ADMIN")) Then


Thanks.
.

Relevant Pages

  • RE: Using AD to grant page and directory accesss
    ... For intranet development.. ... authenticating users/pages against AD groups to determine what pages, ... AD rather than just testing the security of the windows user and AD ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • RE: Reading data
    ... Connection object, it will use the security context of the currently logged ... If you're authenticating to your Intranet (i.e. using Integrated ...
    (microsoft.public.windows.server.active_directory)
  • Re: Riddle me this error ADODB.Recordset (0x800A0E7A)
    ... Authenticating your users is fine, but when you're doing that, yes, it will ... not let anyone in who doesn't have permissions, well, since, that's what ... Does SQL Server need to know who is accessing your intranet? ... need to pass that person's credentials for SQL login purposes. ...
    (microsoft.public.inetserver.asp.general)
  • Configuring SSO against Active Directory
    ... get Tru64 5.1B users authenticating from the user database on ... I've followed the Tru64 Security Administration manual, ... Successful session authentication for firstname_lastname on /dev/pts/2 ...
    (Tru64-UNIX-Managers)
  • Re: Framework bug with Auth and Session state?
    ... I don't know if it is a bug or not, but I experience the same problems. ... I was storing a password in a session variable so ... authenticating using Forms Auth and using a trusted db connection was ... of Forms Auth and password in the connection string (stored in a session ...
    (microsoft.public.dotnet.framework.aspnet.security)
Quantcast