Re: Security model advice, please help!!

The stock usernametokenmanager does do this, yes, I know. HOWEVER, you
cannot NOT send it a password.

I had already done the walkthrough that you linked to. It doesn't cover all
my bases.

In shop floor cases I will have both a username and password create the
usernametoken with. In the case where I'm just supposed to use the current
windows principal, I cannot obtain his password from the principal object to
create the username token, and since the point is to not bother the user with
another sign-in, I can't prompt him for it either.

What can I do, to cover both scenarios?

"Pablo Cibraro [MVP]" wrote:

Hi,

You do not need to impersonate the windows account in order to get the user
groups.
WSE already authenticates the user against a windows domain and gets the
user's groups.

Take a look to this article in the MSDN,
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html/WSS_Ch3_ImpDirectAuth_WSE30.asp

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax

"DevilsChargers" <DevilsChargers@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:C2F81604-5F55-40B2-89D4-CE6D1FA03750@xxxxxxxxxxxxxxxx
We are building an solution where a web service is called from a desktop
app.

We want to secure the calls to the webservice. For right now we are only
concerned with authentication, we do not need to encrypt the message
content,etc. yet.

Working with WSE 3.0. I'm very new to it.

We have two major scenarios that seem to be at odds with one another.

We need to be able to configure the client that we always use their
current
windows login info(we don't want to prompt them to sign in again).

The other scenario is the shop floor. There may/will be a computer on a
plant floor that is used by multiple operators throughout the day. We
want
them to each sign on to the APP(no logging out of windows and logging back
in), as they use it.

We want to use roles(windows groups) to manage permissions on different
tasks.

Problem is, if I use username tokens, I can't validate the users against
the
windows groups because I don't have a windows token to impersonate with.

If I go with Kerberos/Windows, I can't have users other than the user
currently logged on to the windows session.

The only thought I'm having that MIGHT work is using Kerberos all the
time,
and for the users that need to log with different credentials, use
LSALogonUser to gain a windows token for those users. Biggest roadblocks
I
have here is that a) I cant find a clear example of calling LSALogonUser
on
the web, and b) I've tried several examples and have not been able to get
ANY
Kerberos examples to work, I always get an error that says the Security
Header is missing, or something to that effect.



.

Relevant Pages

  • Re: What is the maximal length of usernames on Solaris?
    ... > system to accommodate 4096 character user ID's. ... > 8 characters is to short in many circumstances. ... >>People who whine about petty shit such as how long a username can be ... but Windows uses a backward slash. ...
    (comp.sys.sun.admin)
  • RE: Adding a virtual FTP folder to IIS
    ... I think we can follow the Form Authentication modal. ... application will use the ASPNET account. ... If we change the username ... Windows identity different from that of the default process identity. ...
    (microsoft.public.dotnet.framework)
  • Re: Network shares and printing
    ... Windows cannot obtain the domain controller name for your computer network. ... shared drive and entering proper username and password. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Security model advice, please help!!
    ... (Kerberos and Username). ... use the kerberos policy to consume the service (Using the current windows ... WSE includes a sample to configure different turn-key assertions for the ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Locked out of my computer - please help
    ... > the bottom of the screen to use a Workgroup name. ... > says that either my username or password is incorrect. ... > latest Windows settings that worked. ... > I still do not have a recent backup. ...
    (microsoft.public.windowsxp.security_admin)
Loading