Can I detect authenticated domain users in IIS / ASP.NET without prompting everyone else for credentials?

Question

I am updating an old ASP .NET 3.5 webforms application which uses forms authentication. The requirement is that it needs to automatically log in authenticated domain users whilst still allowing external users to log in manually as before.

To be clear: I need to find out the name of the currently logged in user if they are on the same domain as the server and use this information to bypass the old login system. Not all users will be on the network.

The problem I am having is that although I can get the logged in user from .NET's Request.LogonUserIdentity, I have to disable anonymous access on the relevant page(s) before it will work. What happens is that anyone who is not recognised will receive a login prompt to log in to the domain, but I don't want this as some users do not have user accounts within the domain.

The only solution I can think of is to have a special logon page for domain users that automatically redirects. But it would be nicer if they could just visit any page directly.

The site is running on Windows Server 2003 R2 with IIS 6.0.

Thanks.

Solution

The short answer is no. Unless you have Windows Authentication exlcusively turned on (and all other authentication methods disabled) users won't be authenticated against the domain or the local machine... and you won't have access to this information programmatically.

The long answer is also no. Anonymous Authentication will override Windows Authentication if they are both enabled... IIS will skip other methods of authentication if Anonymous is enabled. If Windows authentication is enabled (any Anonymous is disabled) IIS will send the Kerberos / NTLM challenge and only then (after prompting) will the browser send credentials. Internet Explorer will send Kerberos info without prompting if within the intranet zone. -Chris

Comments

[James]

When I first searched Google before posting I guess I wasn't using the right keywords because I later discovered a load of articles confirming what you said. The strange thing is that I thought I had it working at one point, but the browser must have been caching credentials.