Suggestion please..

I have a scenario, need your suggestion..
Our clients are already using the forms authentication where we check the
User/Pwd from SQL svr Database. We also have some SETTINGS for the user save
d
in the database(helps us to restrict the user access some things) .
We wanted to implement AD authentication for the same and also keep the
existing SQL SVr User DB.
My Q would be how to MAP the LDAP user to the SQL svr User, so we can get
the SETTINGS defined for the user in the SQL svr Database.
Any suggestion is appreciated..
Thanks
Vinay
http://pathidotnet.blogspot.com
=====
vInAypAtHi
o__
--_,>/'_--
(_) \(_)
--Following URL maybe is helpful:
http://msdn.microsoft.com/library/d...
d16.asp
Elton Wang
"vinay" wrote:

> I have a scenario, need your suggestion..
> Our clients are already using the forms authentication where we check the
> User/Pwd from SQL svr Database. We also have some SETTINGS for the user sa
ved
> in the database(helps us to restrict the user access some things) .
> We wanted to implement AD authentication for the same and also keep the
> existing SQL SVr User DB.
> My Q would be how to MAP the LDAP user to the SQL svr User, so we can get
> the SETTINGS defined for the user in the SQL svr Database.
> Any suggestion is appreciated..
> Thanks
> Vinay
> --
> http://pathidotnet.blogspot.com
> =====
> vInAypAtHi
> o__
> --_,>/'_--
> (_) \(_)
> --
Elton
Thanks for the link, i have done the LDAP authentication already.
I am looking for a way to link the LDAP user to the existing SQL svr user.
Thanks
--
http://pathidotnet.blogspot.com
=====
vInAypAtHi
o__
--_,>/'_--
(_) \(_)
--
"Elton W" wrote:
> Following URL maybe is helpful:
> http://msdn.microsoft.com/library/d...r />
mod16.asp
> Elton Wang
>
> "vinay" wrote:
>

Suggestion please..

I have a scenario, need your suggestion..

Our clients are already using the forms authentication where we check the
User/Pwd from SQL svr Database. We also have some SETTINGS for the user saved
in the database(helps us to restrict the user access some things) .

We wanted to implement AD authentication for the same and also keep the
existing SQL SVr User DB.

My Q would be how to MAP the LDAP user to the SQL svr User, so we can get
the SETTINGS defined for the user in the SQL svr Database.

Any suggestion is appreciated..

Thanks

Vinay

--
http://pathidotnet.blogspot.com
=====
vInAypAtHi
o__
--_,>/'_--
(_) \(_)
-----Following URL maybe is helpful:

http://msdn.microsoft.com/library/d...ml/secmod16.asp

Elton Wang

"vinay" wrote:

> I have a scenario, need your suggestion..
> Our clients are already using the forms authentication where we check the
> User/Pwd from SQL svr Database. We also have some SETTINGS for the user saved
> in the database(helps us to restrict the user access some things) .
> We wanted to implement AD authentication for the same and also keep the
> existing SQL SVr User DB.
> My Q would be how to MAP the LDAP user to the SQL svr User, so we can get
> the SETTINGS defined for the user in the SQL svr Database.
> Any suggestion is appreciated..
> Thanks
> Vinay
> --
> http://pathidotnet.blogspot.com
> =====
> vInAypAtHi
> o__
> --_,>/'_--
> (_) \(_)
> -----
Elton

Thanks for the link, i have done the LDAP authentication already.

I am looking for a way to link the LDAP user to the existing SQL svr user.

Thanks
--
http://pathidotnet.blogspot.com
=====
vInAypAtHi
o__
--_,>/'_--
(_) \(_)
-----

"Elton W" wrote:

> Following URL maybe is helpful:
> http://msdn.microsoft.com/library/d...ml/secmod16.asp
> Elton Wang
>
> "vinay" wrote:
> > I have a scenario, need your suggestion..
> > Our clients are already using the forms authentication where we check the
> > User/Pwd from SQL svr Database. We also have some SETTINGS for the user saved
> > in the database(helps us to restrict the user access some things) .
> > We wanted to implement AD authentication for the same and also keep the
> > existing SQL SVr User DB.
> > My Q would be how to MAP the LDAP user to the SQL svr User, so we can get
> > the SETTINGS defined for the user in the SQL svr Database.
> > Any suggestion is appreciated..
> > Thanks
> > Vinay
> > --
> > http://pathidotnet.blogspot.com
> > =====
> > vInAypAtHi
> > o__
> > --_,>/'_--
> > (_) \(_)
> > -----

suggestion to improve cookieless session state

Whidbey finally gives us cookieless forms authentication, which is a great new feature. But, to make it even better the .Net team gave us more than a simple true/false setting. Instead, we can set the "cookieless" attribute of the <forms> element to "UseUri", "UseCookies", "AutoDetect", or "UseDeviceProfile". This level of control and flexibility is amazing, but it got me thinking... why not add this same feature to the <sessionState> element? Currently, the "cookieless" attribute of the <sessionState> element only accepts a true/false value. Would it be possible to extend it to support the same set of values that the <forms> element now accepts? Of course, it would still have to accept true/false as well for backward compatability.I think it's a great idea.

suggestions for smart card or biometric web authentication?

Anyone have suggestions for biometric or smart card or key fob or [whatever
else] authentication of a future public facing website? For example, a
customer could do something to authenticate themselves and the computer
passes some data in the background of their browser session so a user can be
authenticated better than the typical "username/password" fields? We'd use
ASP.NET 2.0 on the server side. I see a few miscellaneous tools in a google
search but nothing is jumping out at me. For example, one is not really
..NET compatible but you could work around that. Not great. We also need
something affordable. Considering that online banking sites are exploring
better options to prevent spyware from grabbing usernames/passwords, I was
hoping someone in this group might have done some research into this already
and have some concrete thoughts or suggestions.

User Group Etiquette: Please don't be the first to reply to this post
unless you have something truly helpful to add, else others will think I've
already been helped and not read the post.HK:

You can have a look at our opensource two-factor authentication
solution:

http://www.wikidsystems.net (or
https://sourceforge.net/projects/wikid-twofactor/) and our commercial
site: http://www.wikidsystems.com.

We currently have a COM object for windows apps, but we're also working
on an ISAPI plugin.

In addition, the PC clients for mac, linux and windows can do mutual
authentication - i.e. host & user auth, which prevents MITM attacks. It
can run on a usb device. The commercial version supports wireless
devices - Blackberry, cell phones, Palm, WindowsMobile.

suggestions for smart card or biometric web authentication?

Anyone have suggestions for biometric or smart card or key fob or [whatever
else] authentication of a future public facing website? For example, a
customer could do something to authenticate themselves and the computer
passes some data in the background of their browser session so a user can be
authenticated better than the typical "username/password" fields? We'd use
ASP.NET 2.0 on the server side. I see a few miscellaneous tools in a google
search but nothing is jumping out at me. For example, one is not really
.NET compatible but you could work around that. Not great. We also need
something affordable. Considering that online banking sites are exploring
better options to prevent spyware from grabbing usernames/passwords, I was
hoping someone in this group might have done some research into this already
and have some concrete thoughts or suggestions.
User Group Etiquette: Please don't be the first to reply to this post
unless you have something truly helpful to add, else others will think I've
already been helped and not read the post."HK" <replywithingroup@.notreal.com> wrote in
news:ZHhtf.6970$pE4.4961@.tornado.socal.rr.com:

> Anyone have suggestions for biometric or smart card or key fob or
> [whatever else] authentication of a future public facing website?
Biometrics is still in its infancy - at least for the web.
As for keyfobs, take a look at RSA Security's SecureID authentication.
Also Entrust provides secure identity solutions.
SecurID needs a bit of fudging to work with ASP.NET:
http://sourceforge.net/projects/securid4dotnet/
A cheaper solution maybe to use client-side certificates. You send a
certificate to each user:
http://support.microsoft.com/defaul...b;EN-US;Q315588
So to authentication, a user will need a password + certificate.
But I guess a bigger question is - are you going to provide all your
customers keyfobs or biometric readers? This stuff doesn't come cheap.
Also, are you willing to deal with all the support issues? Perhaps you
should consider building better logging/monitoring tools - and force
users to reset there passwords often?

> User Group Etiquette: Please don't be the first to reply to this post
> unless you have something truly helpful to add, else others will think
> I've already been helped and not read the post.
Newsgroup (usenet)... not user group!
Anyhow, I don't think there is such an "etiquette" rule. What one
considers junk maybe gold for another? : ) You can always repost if you
don't like the answers!
Stan Kee (spamhoneypot@.rogers.com)
HK:
You can have a look at our opensource two-factor authentication
solution:
http://www.wikidsystems.net (or
https://sourceforge.net/projects/wikid-twofactor/) and our commercial
site: http://www.wikidsystems.com.
We currently have a COM object for windows apps, but we're also working
on an ISAPI plugin.
In addition, the PC clients for mac, linux and windows can do mutual
authentication - i.e. host & user auth, which prevents MITM attacks. It
can run on a usb device. The commercial version supports wireless
devices - Blackberry, cell phones, Palm, WindowsMobile.