3

Could anyone please share any thought on authenticating Active Directory users using the AuthType.Kerberos method.

Ideally, I would like to pass the Username and Password to validate the user credentials using the AuthType.Kerberos method

This type of validation uses LDAP connection (LdapConnection)

Any comments or feedback will be very appreciated.

Cheers! :)

Platinum Azure
  • 45,269
  • 12
  • 110
  • 134
theITvideos
  • 1,462
  • 2
  • 18
  • 29

1 Answers1

5

Kerberos doesnt use a username and password in the sense you are talking about here, it uses a ticket based auth system with a central server. Kerberos is quite complicated to implement and is normally only used in cases where you want to do double hop authentication with the logged in user. This means the application wants to use the credentials of the user who has logged in to access a secondry system. For example if you have a SharePoint site which pulls data from exchange server you may want to pass the currently logged in users details from sharepoint to exchange. This is normally done with Kerberos and Constrained Delegation.

In reality what you probably want for your application is Windows authentication (NTLM) which allows the application to authenticate domain users, (However again in the common case this doesnt use a username and password at your application level either).

===EDIT===

To implement kerberos with a .Net webapp you will need to do the following

This article has some good advice around how to troubleshoot problems with the system http://blogs.technet.com/b/askds/archive/2008/05/29/kerberos-authentication-problems-service-principal-name-spn-issues-part-1.aspx

undefined
  • 33,537
  • 22
  • 129
  • 198
  • Thanks for the reply. I would like to ask you how I can set the OldPasswordAllowedPeriod for the User? Because this is the situation I am facing: http://stackoverflow.com/questions/8949501/why-does-active-directory-validate-last-pasword And someone suggested that I either go with AuthType.Kerberos or set the OldPasswordAllowedPeriod. Kindly see here: http://stackoverflow.com/questions/8949501/why-does-active-directory-validate-last-pasword – theITvideos Jan 22 '12 at 09:30
  • Updating the users password (or changing any user details) is actually a double hop scenario (if you want to do so using the current users credentials). This is because the user who has logged into your application then needs to have their ticket passed to the AD controller to allow the edit. I have added some links to my post around where to go in terms of actually implementing a kerberos solution, however be aware its not a simple task and you will need a domain administrator to do some stuff. – undefined Jan 23 '12 at 09:20