1

I'm not sure that this is possible but I figure at worst, I'll be told you cannot do that.

Our organization has a report server that sits in a DMZ accessible by multiple units that have their own Active Directory Domains. There is no internet access to the DMZ (which is the only reason I'm even considering this solution as I realize that it is a big reduction in security). The server uses an authorization database to control what links and panels are visible and accessible to the viewer. No passwords are stored in the database, just Domain\Username combinations.

What we would like to happen is this. We want to rely on the fact that if the user had signed into their own system and had authenticated against their AD, then they are who they say they are. We would compare their user name against the authorization database and grant them access based on their roles.

We cannot use IIS Anonymous Authentication because we cannot access the viewer's logged on user name. Using any other Authentication doesn't work because the site then asks for user name and password which we cannot authenticate against multiple domains.

Essentially we want to short circuit Windows Authentication so that we automatically allow them to see the site but we can also retrieve the viewer's domain and user name.

I've looked at many SSO posts but all of them require the viewer to sign on once at the website level and/or deal with multiple sites across the domains. It seems to be a bit of overkill for this project to build out an SSO domain for one site that will only be accessed internally.

1

Automatic authentication does only work for manually configured proxies (eg, when a browser is set to use a proxy, it can be configured to do a automatic "windows authentication" to this proxy) for obvious security reasons - the reason is that else, any site in the whole world would be able to obtain valid hashed authentication credentials, which could be used in pass-the-hash attacks.

But there is a solution you could use: Configure your AD server, to record the client IP of the computer in question, along with username/domain, when it has authenticated. And configure the AD server to delete this record of IP when a computer logs out.

Then, in the intranet site in question, you use the client IP to query the database that AD created, and check which username it is.

Of course, this wouldn't, as you say, give high security, but it would atleast give some security, while still having the convience of not having to login all the time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.