Windows authentication essentially means you are letting users into your web site if they have a valid AD user id and password in a specified group. It is simple and works great for an intranet application. It's important to note that IIS is responsible for the actual authentication. So first, you need to enable Windows Authentication for the site. To accomplish this:
- Open IIS.
- Select the site.
- Click "Authentication" in the IIS group.
- Disable "Anonymous Authentication"
- Enable "Windows Authentication"
It's possible that Windows Authentication has not been installed on the web server. If this is the case, you will need to enable that feature through the control panel.
At this point, when a user browses to your site, the browser will see that anonymous authentication is disabled and will display a login box because of the windows authentication. Once, the user authenticates, IIS sends the user information to the actual web application. At this point, it is up to the web application to authorize the user.
This authorization is configured in your web.config. Here is an example that restricts access to users in a certain AD group:
<configuration>
<system.web>
<authentication mode="Windows" />
<authorization>
<allow roles="PowerUsers" />
<deny users="*" />
</authorization>
</system.web>
</configuration>
Remember that the allow element takes precedence of the deny element.
To get the user name on an aspx page, simply type
User.Identity.Name. To get the user name in .net server side code, use the fully qualified
System.Web.HttpContext.Current.User.Identity.Name.