Windows authentication for Intranet/Internet

Question

I am developing an ASP.net web application for my company. Some users use this site in the internal network (Intranet) and some use the Internet site. I am using Windows Authentication mode.

I need to find a way to not prompt Windows Authentication mode for an Intranet user and prompt Windows Authentication mode for an Internet user.

How can I do this?

Answer 1

Based on what your are describing, Windows Authentication in IIS will do the trick.

First some links:

• Technet as an article about the Windows Authentication in IIS here
• MSDN tells you how to use Windows Authentication with ASP.NET 2.0 applications here

However note the following:

Single sign-on (SSO) (i.e. accessing the application without providing a username and password) will occur if all the following are true:

• The client computer and the server are part of the same Active Directory domain.
• The user session on the client computer is a user from the AD domain.
• The client computer has access to a domain server (i.e. the server responsible for the user login)
• The browser is Internet Explorer.
• The URL used points to the FQDN of the server (i.e. http://SERVERNAME.DOMAIN.NAME/ not just http://SERVERNAME/
• The authorized users must have read access to the application directory if you are using impersonate. The application will be running with their credential basically. (more details in the MSDN article)

Under any other circumstances the user will be prompted for credential (username and password) for an account within the Active Directory Domain. So user accessing your webserver from the internet would get a popup asking them to provide a username and password.

Be advised that for user not using single signon (user being prompted for username and password) the HTTP authentication mode will most likely be BASIC which mean that anybody that can intercept that connection will be able to see the username and password being exchanged. If you go with this technique make that the connection between client and server is encrypted (HTTPS or maybe a VPN).

Answer 2

Make sure your webserver is running on a domain and all your Intranet users have read access to the folder containing your website on the Web server.

Then, make sure you have in your web.config (assuming you want to detect which domain user is accessing your site.

Finally, open the IIS manager and right-click the website and choose "Properties". From there click the "Directory Security" tab and click "Edit" by Authentication and Access Control. Uncheck "Anonymous Access" and make sure "Integrated Windows Authentication" is checked. This should make the website behave as expected (assuming your intranet clients use IE)