How to combine integrated security and native user database with IIS / C # 3.5?
Can all of these access controls be mixed in one site?
I have a requirement:
- a) Users from AD must be allowed access using built-in security
- b) Users from another AD must be allowed access; potentially login
- c) Non-AD users should be able to create a new account on the site.
Now, of course, I would like the site not to care about where the user was authenticated; just that he was.
What is the best way to achieve this?
source to share
I did something like this on a project a while ago and it worked like this:
I have set up an application to use anonymous access authentication in IIS.
I created a standard Autodesk Forms login page that accepted a user ID and password for non-integrated logins.
I also made a dedicated .aspx page for integrated security login and set ONLY so that one page uses integrated security (not anonymous access) in IIS. This page has manually generated an authentication form ticket based on credentials from IIS.
On the main forms-based authentication registration page, I looked at the incoming address in the request to see if it was from the local network, and if so, redirected to the built-in security login page (so the user did not receive a prompt for a user ID and password. it just registered them with security built in).
I also made the forms authentication login page smart enough to determine based on your user id if you are an AD user, and do an LDAP versus AD search if necessary to validate your password. This allowed users with AD accounts to log on using their AD credentials, even when not on the local network (and therefore does not use integrated security). For non-AD users, validation was performed against a separate list of user IDs and password hashes supported by the application.
source to share
I think there is an answer from the person himself . Basically you should use the regular asp.net membership provider model. But create your own custom provider that migrates the active directory and sql provider. Possibly two different active directory providers.
source to share