RE: Securing through the IIS web server domain logon

["Michael Howard" <mikehow () microsoft com>]

If all your app needs is the username, you can simply set IIS to do
Windows auth, and then your code can access the
Request.ServerVariables("AUTH_USER") to get the user name.

[Writing Secure Code] http://www.microsoft.com/mspress/books/5957.asp
[Protect Your PC] http://www.microsoft.com/protect
[Blog] http://blogs.msdn.com/michael_howard

[On-line Security Training]
http://mste/training/offerings.asp?TrainingID=53074


-----Original Message-----
From: Koniszewski, Jeffrey [mailto:JKoniszewski () Kronos com] 
Sent: Tuesday, August 17, 2004 2:21 PM
To: webappsec () securityfocus com
Subject: Securing through the IIS web server domain logon

Our application provides security via an application logon and web
application session. We layer lots of access control on top of the user
session. The web server is set to serve up files via the iusr account,
i.e. web server access is via anonymous logon.

We have a customer with high security needs that wants to restrict
directory access on the web server to domain authenticated users (remove
iusr access). This, as I understand it, would require the web server to
prompt for domain authentication. Then file access on the web server
would be via the authenticated domain user's account. However, our
application still needs to authenticate the user as well. Actually, all
we probably need is the user name. We have never set up to work this
way. Is there a way to get the user name from the IIS domain logon? Is
it accessible via the HTTP session? Thanks.