SSO advice

[michaelr]

We are looking to implement Single Sign On (SSO) for our intranet and other
internal applications.

Our plan is to have an ASP.NET “portal page� which will examine the
WindowsIndentity of the IIS-authenticated user, and present links for the
applications that the user has authorization.

In order to minimize custom programming efforts, we would like to leverage
built in Windows functionality for authorization and authentication as much
as possible for both the portal and downstream components and applications.

Our research has led us to the conclusion that using Windows Integrated
Authentication on IIS is the most effective way to authenticate the user. For
application authorization, we may use Active Directory Application Mode
(ADAM) or a custom SQL database.

However, it would be desirable to force the user to enter their credentials
upon initial logon, rather than automatically picking up the network logon.
We are concerned that Basic authentication (with HTTPS) may present
difficulties if our applications are spread across several machines.

Anyone have experience/advice on this?

[Daniel Fisher\(lennybacon\)]

If the Apps all run in a Domain or same machine just turn off anonymous
access in IIS.

--
Daniel Fisher(lennybacon)
MCP C# ASP.NET
Blog: [url]http://www.lennybacon.com/[/url]



"michaelr" <michaelr@discussions.microsoft.com> wrote in message
news:341C7177-49C7-4D73-BDDF-5B1367402574@microsoft.com...

> We are looking to implement Single Sign On (SSO) for our intranet and
> other
> internal applications.
>
> Our plan is to have an ASP.NET "portal page" which will examine the
> WindowsIndentity of the IIS-authenticated user, and present links for the
> applications that the user has authorization.
>
> In order to minimize custom programming efforts, we would like to leverage
> built in Windows functionality for authorization and authentication as
> much
> as possible for both the portal and downstream components and
> applications.
>
> Our research has led us to the conclusion that using Windows Integrated
> Authentication on IIS is the most effective way to authenticate the user.
> For
> application authorization, we may use Active Directory Application Mode
> (ADAM) or a custom SQL database.
>
> However, it would be desirable to force the user to enter their
> credentials
> upon initial logon, rather than automatically picking up the network
> logon.
> We are concerned that Basic authentication (with HTTPS) may present
> difficulties if our applications are spread across several machines.
>
> Anyone have experience/advice on this?
>