Login with Windows Authentication on IIS

Question

I have a base Sqlserver 2008 where all users can connect to it via Windows domain, this works properly via SQL Management Studio.

I am making a C# Application in MVC, and I wanted that when the user accesses the site, I could take this login and password of windows and pass to mount my Connection String.

My String Connection is like this:

conexao = new SqlConnection("Data Source=vc9;Initial Catalog=sgt;Integrated Security=SSPI;Application Name='Controle de Sprint';Pooling=False;User ID=dominio\\usuario;Password=senha;");

So it works, but I can’t get via C# to catch the Windows user of the user who is accessing the site.

It’s got to be done?

Answer 1

You cannot get the password from the logged-in user, this goes against Microsoft’s security policy. You can set up an AD account on Application Pool of IIS to make the connection, and can make your system get the user logged in (Windows) in your application, without problems. However, the password you cannot.

For your system to get Windows authentication, just change your web.config for that reason:

<configuration>
  ...
<system.web>
    <compilation debug="true" targetFramework="4.5" />
    <httpRuntime targetFramework="4.5" />
    <authentication mode="Windows" />
    <authorization>
      <deny users="?" />
    </authorization>
  </system.web>
  ...
</configuration>

For more information, see this answer.

And to get the user logged in, just use something like this:

var usuario = User.Identity.Name;

or depending on where you want this data, this way:

  var usuario = HttpContext.Current.User.Identity.Name

And if you don’t forget to modify the IIS to accept the connection via windows.

On this website you find a tutorial on how to do this.

Answer 2

you must first configure your IIS to perform authentication using Windows Authetication.

To do it in the development environment, open the visual studio, right-click the Mouse on the Project, choose Use IIS Express, should he appear Use Visual Studio Developement Server is pq is already using IIS Express, then need not perform any further action.

Again use the right mouse button, go to Properties/Propriedades and set Anonymous Authentication for false and Windows Authentication for true.

Once the application is published, you need to do the same on the IIS where the application is hosted. to do so select your aplicação, then on the tab IIS choosing Authentication. Set again Anonymous Authentication for false and Windows Authentication for true.

Once done, modify your connection to use Trusted_Connection or Integrated Security. it is not necessary to inform id and password, it will log on using the network user (windows).

<connectionStrings>
  <add name="MyDbConn1" connectionString="Server=MyServer;Database=MyDb;Trusted_Connection=Yes;"/>
  <add name="MyDbConn2" connectionString="Initial Catalog=MyDb;Data Source=MyServer;Integrated Security=SSPI;"/>
</connectionStrings>