I have tried my best to search the web before asking this question. I've seen similar questions on stackoverflow, however, none has been answered satisfactorily for a long time now. This is one more attempt to get this recurring question answered.
The Problem
How to build an ASP.NET MVC 5 website which uses "Windows Auth" for Intranet users and "Forms Auth" for Internet users? We'd like to accomplish this using ASP.NET Identity. Moreover, we don't want to use Active Directory Groups for authorization. For Intranet users, we want to authenticate them using Active Directory and then fall back to ASP.NET Identity to manage their roles and other profile data.
It'll be nice if we don't ask the end user to choose auth method. The web app should log in intranet users seamlessly. They shouldn't even know that there is a login screen. Likewise, the internet users shouldn't be asked to enter their domain credentials. They should see form based login screen right away.
Is there any recommended way of solving this? Or could you comment if any of the following are proper solutions?
http://world.episerver.com/blogs/Dan-Matthews/Dates/2014/8/Mixing-Forms-and-Windows-Authentication/
https://github.com/MohammadYounes/MVC5-MixedAuth
http://mvolo.com/iis-70-twolevel-authentication-with-forms-authentication-and-windows-authentication/
FYI This is 2004 article, may not be helpful now:
https://msdn.microsoft.com/en-us/library/ms972958.aspx
IIS configuration
Enable Anonymous Authentication status in IIS for the whole site and Windows Authentication for some folder under root directory (for example, /WindowsLogin). In this folder place aspx file (for WebForms project) or create ApiController (for MVC project).
Site setup
On login page add button “Login with Windows/ActiveDirectory account” (in similar way as it is common practice to add buttons Login with Twitter, Facebook, Gmail, etc.). When user presses this button, they will be redirected to the page or controller in /WindowsLogin folder, which require Windows authentication. If site uses some Single Sign-On functionality, locate it in that page or controller, in other case just save Session for Windows users there. If user accessed that page or controller, they had been authenticated as Windows users already.
One of the possible ways could be creating two sites in IIS, but having the same target folder, where sources of site are located. First site is for internal users with enabled Windows Authentication mode and binding to 80 port, while second site is for external users with Anonymous mode enabled and binding to 8080 port, for example. Then, on firewall you will have to configure NAT, that all requests coming from within local network or VPN, will be redirected to local IIS server on port 80 and all requests coming from Internet, will be redirected to port 8080 of IIS server.
The term for this is Mixed-Mode Authentication. I have done this multiple times. You only need to tweak your main site. Here is how I have done it.
Keep your main MVC site as-is but run it as Anonymous vs. under Windows Auth.
Internal Site
Create a Redirect URL Site: Setup this site as Window Auth so you can pull the User ID from Active Directory. Give your users this URL and/or make it the link they click on your Intranet. Then this site calls your MVC Site and passes the user credentials (login id).
a. This can be done either via an encrypted string on the URL or encrypted value in a cookie. You can encrypt with an expiration date/time value too.
b. (Speaking from Forms Auth) Create a Forms Authentication Ticket with that user ID. Run any other login logic you have. Done.
External Site - No Changes required. Let the users login as-is.
Are you wanting to handle forms and AD authentication from one URL? I have used thinktecture (claims based auth) as the framework for WIF and marshaling various forms of authentication. However to handle if from one URL I had to handle some logic at login that associated the user to AD or Forms based. In a more recent project, this was handled at user management when we created the user account (it was associated to AD of Forms Auth). Then when the user logged in they would preface the AD domain name as part of the login. There are a number of ways to implement this, this was just one I have used. An example, instead of requiring the domain, just use the username, then check for AD or forms based flags on the username and then handle authentication accordingly
EDIT
Just an update in re-reading your question. Are the internet users and intranet users the same? If so you need to just go forms based auth across the board and manage the users in the product DB independent of AD. If they are the same then they could login prefacing the domain name to username. if you wanted to rely solely on AD.
I did a proof of concept of this some time ago, at my previous job, so the details are hazy and I don't have any code to refer to...
The requirements were:
Single URL for internal (LAN) and external (internet) access
Two types of users, people on the domain and external (non-AD) users
Windows authentication for domain users both internally and externally
The ability to enter domain logon details when using iPads (no windows auth)
The core idea in the solution I came up with was that we used Active Directory Group Policy to add a custom string to http request header user agent, the content doesn't matter, in fact we used a long random string of characters.
https://technet.microsoft.com/en-us/library/cc770379.aspx
Then the landing page for the site checks for this, and if found redirects to a virtual directory, with windows auth, that checked their AD account, populated the ASP.NET authentication token and then redirected them to their home page.
If the custom header isn't there then it just displayed the normal login form.
The only other thing was to add an AD email/password check to the normal login form so that if a domain user accessed the site from a non-windows device (iPad) then they could use their normal login details.
Why not put your website code on the server, robocopy it to two separate websites and just handle the changes in authentication by configuring the web.config. (one would be setup with anonymous and one with windows authentication.)
It's not as snazzy as other methods but it's relatively painless. There are two sites but the content (except for the web.config) are identical.
We are trying to implement single sign on for two different web application located at different domain
WebApplication 1 (this will act as a front end where user log in)
WebApplication 2
the basic usage idea will be
User sign in trough a login screen in WebApplication 1
User click on a link in WebApplication 1 which will then open a popup screen to WebApplication 2 without signing in again
Now in order to achive this we created an ETL script which runs every 1 hour to synchronize the user and group accounts from web application 1 database to web application 2 database
Question
is there a better way to achieve single sign on rather then writing
a script that synchronize user account every 1 hour?
I have read new technology call WIF(Windows Identity Foundation) that is built in to .net framework 4.5 will this help to solve my issue above?
Running a script every hour is not a good idea as it be overhead on the server
To achieve single sign on for the different domain can be bit tough but not really impossible, It becomes difficult only because we cannot share the cookie across different domain. So we can have one different server for single sign on
When the user visit the web-application 1, redirect user to SSO server.
Once the user is redirected to the SSO server, check if the cookie exist, as its for the first time there will be no cookie so show the login page which is hosted on SSO server.
After getting the credential from the user validate the user
If the user is valid, generate a token now this token can be unique hexadecimal number or hash for the timestamps.
Set this token into the cookie on the SSO server and redirect the user back to the original site or success page
Now when user visit the web-application 2, redirect the user to the SSO server again
Once user comes to SSO, check for the cookie, if it exist and not expire then redirect user directly to the success page without asking for login credential again or show the login page and follow the drill again
As we are redirecting the user on the different server, we can set the cookie there with the common name as 'SSOcookie' and every time access the same when coming from different application. This will help you to achieve single sign on for different domain.
I have multiple websites in different virtual folders on the same server. I created a UserManager Website for an admin to create the user accounts for the websites. I am using aspnet tables and login forms.
The problem is when I add a login page to another website, the login is successfull but wont redirect them to the Main page of that website because the ApplicationID doesn't exist. Is this possible?
You should look into AD FS authentication. It's basically like a single sign for Active Directory.
If you are using forms authentication in order to authenticate to all applications you should:
Make sure to make your cookie is a domain cookie (add a period to the beginning of the cookie name in the forms authentication tag of the web.config file)
Add machine key to make sure the applications can decrypt the cookie
I've 2 web site. From web site 1 I need to execute login into website 2 and return to original requested url (requested url of website 1).
On login click, whan I execute Response.Redirect(FormsAuthentication.GetRedirectUrl("...", false)) I always achieve something like "http://website2/requestedPage.aspx", instead, I should getting the first website : "http://website1/requestedPage.aspx".
In other words, GetRedirectUrl method aòways assume that I'm working in the same domina, so web site name is implied.
Of course I could to explicit webSite name, but I don't want it because tomorrow, maybe I'll have to do login from another one web site.
Is there a simple way to get web site name that required login function?
That's not possible because forms authentication is bind to one domain only, the forms authentication needs an cookie to verify and cookies can only be set for a specific domain.
If you want to setup a login for multiple sites you have to look at an single sign-on solution.
Our client's site currently uses forms authentication, so users have to go to the login page to type in their username and password. There are custom membership and role providers that access a database through NHibernate to get users and roles.
The client now wants users from within the local Active Directory to get logged in automatically. Details of users and roles should still be retrieved from the same database as before. There will be a new field added to the Users table that holds an Active Directory username so that I can match it up.
If the current user is not authenticated through Active Directory or no record in the Users table has a matching Active Directory name then they would have to go to the login page as normal. To be clear: the site must still be accessible externally (i.e. outside the domain).
I have a test system setup that involves an IIS 6 server and a client running IE7; both are members of a test Active Directory. I've tried using HttpContext.Current.Request.LogonUserIdentity in combination with IIS integrated security but it's returning the anonymous login except when browsing on localhost.
Does anyone have a solution?
You want to check out Integrated Windows Authentication. This will allow the Active Directory username and password (hashed) to be sent across the network to the server. If they pass you can redirect them to the site, and if not, push them to the login page.