Security for ASP.NET application running on intranet / VPN
- by Ryan
Hi,
I have an ASP.NET app that sits on our intranet, using the WindowsIdentity to identify the user:
WindowsIdentity wi = HttpContext.Current.User.Identity as WindowsIdentity;
if (wi == null || wi.Name == null)
{
noAccess("No WindowsIdentity");
return;
}
string username = wi.Name;
if (username.Contains("\\"))
username = username.Substring(username.LastIndexOf("\\") + 1);
This works fine on our Intranet. However, when users from other offices (separate network, with firewall open) they get a password request input box.
Why are they getting the password dialogue?
What is the recommended way identify users of the app? I want to avoid using password, but windows identities. Anyone attempting to access the application is inside a trusted network.
Thanks a lot for any help
Ryan