asp.net and windows authentication help

[lilelvis2000]

Your client is not quite understanding windows security.

Your external users will be authenticated on the external AD. You will have no access to this from your internal AD unless a domain trust exists.

For SSO to work, your external users need to be authenticated on the domain. VPN access or some such. Once they are authenticated on the domain, they will receive a token, which contains the SID.

For info, your users SID and SamAccountName are cached in the IIS metabase. So if a user changes their name, SSO will break for them until you flush the cache on IIS, either by bouncing the box, restarting the w3c, restarting the app pool or logging in on that box with the user account that has changed.

asp.net - IIS Returning Old User Names to my application - Stack Overflow

This is what I keep telling them...but I think the middle man is the problem. All I get back is that the app must hit both ADs. Anyway I think can hack something akin to what I was describing above..with the fake authentication, then a AD check than a revoke if necessary.

I've been on this three days now..it was only scheduled for four!

middle man is the "architect"..he's got far less experience than me and he's a arts grad who pretends to be a programmer. the most annoying bit that all the code is vb.net...so it takes twice as much text to do everything.

[suityou01]

This is what I keep telling them...but I think the middle man is the problem. All I get back is that the app must hit both ADs. Anyway I think can hack something akin to what I was describing above..with the fake authentication, then a AD check than a revoke if necessary.

I've been on this three days now..it was only scheduled for four!

middle man is the "architect"..he's got far less experience than me and he's a arts grad who pretends to be a programmer. the most annoying bit that all the code is vb.net...so it takes twice as much text to do everything.

[1] Kerching
[2] Ah. Kerching.
[3] Mmmm. Kerching.
[4] Keeeeeeeeeeeeeeeeeeeerching.

[lilelvis2000]

[1] Kerching
[2] Ah. Kerching.
[3] Mmmm. Kerching.
[4] Keeeeeeeeeeeeeeeeeeeerching.

What it is frustration.

I am told that as they are a global company trust can't happen. Well there goes the project then.

[suityou01]

What it is frustration.

I am told that as they are a global company trust can't happen. Well there goes the project then.

No. Dry your eyes and start doing something about it. I would suggest putting together ann options paper (don't forget a do nothing option).

Compare and contrast your options. Let the business decide. If they choose an option that is loads of work and reinventing the wheel. Keeeeeeeeeeeeeeeeeeeeeeeerching.

If they choose to introduce domain trusts on the back of your option paper, then you have a great little war story for a future interview.

You are more in control than you realise.

[lilelvis2000]

No. Dry your eyes and start doing something about it. I would suggest putting together ann options paper (don't forget a do nothing option).

Compare and contrast your options. Let the business decide. If they choose an option that is loads of work and reinventing the wheel. Keeeeeeeeeeeeeeeeeeeeeeeerching.

If they choose to introduce domain trusts on the back of your option paper, then you have a great little war story for a future interview.

You are more in control than you realise.

I finally managed to crack the middle man nut. He finally came round and has said that he "believes" there is a trust and is speaking to their internal dev department about the setup.

If that happens than I can at least simulate things with a local setup. All I'd need to do is get some name/email info from the AD. and web.config can handle the group authorisation.

Should have the details by end of day...which is almost here. Hmmmm..

Well, at least I got to work on my tan today! even if I earned £0..