3

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group.

The naive way is to send System.Environment.UserName to the server and let it determine the user permissions in this way.

However, it seems to be against best practices since any client can spoof the user name.

Is there an API I can use to send the credentials in a trusted manner to my server application, over a TCP socket?

SSL is not enough, since anyone can establish a secure connection, yet still spoof the username.

2

In an Active Directory world, assuming that both client and server live in the same domain, then the authentication which occurred on the client can be shown to the server, in a way which will convince the server. This works because an authenticated user on a machine gets a "ticket" which is actually a kind of reference authenticated by the AD server; when the client shows the ticket to the server, the server can show it to its AD server, and the AD server will respond that indeed the ticket is fine. Details can be complex but you can leave all the work to the Microsoft libraries.

If the server-side is an IIS server with ASP.NET, and the client uses .NET, then this is quite simple to configure. If you want to do the work yourself, e.g. by using direct TcpListener and TcpClient, then this will entail, indeed, more work; see the links provided by @makerofthings7.

Note that you will still want to use SSL, to thwart eavesdroppers.

If client and server are not part of the same domain, then things become a bit more complex, because the client application must somehow obtain the right credentials (i.e. the user name and password) for the server's domain, while the application runs in the distinct client's domain. Alternatively, you can use certificate-based client authentication, which can be coupled with SSL; in that case, the client user must have an appropriate certificate and private key installed in his personal certificate store, and the application will use that.

  • Sounds like in my case I need to obtain an authentication ticket and present it to the server for validation then. – Josh Wyant Jun 23 '14 at 18:17
1

I'm assuming you are using a fat WPF or Forms client, and not a webpage, because the easy answer is ADFS v2 in passive mode.

If you're using raw TCP, you'll have to invent much of the work yourself, since you need to authenticate the TCP connection "somehow". ADFS v2 also works with active clients, and there are samples in the SDK.

Best bet for TCP/IP based connections is to use RPC, specifically WCF, ( Windows Communication Foundation) with ADFSv2.

Why did you tag this LDAP? Does it add context to the question? Please elaborate.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.