wrong user/password didn't checked at AD

Question

User-883890505 posted

Hi All,

I have created an MVC 5 Application with Windows Authentication,

<authentication mode="Windows" />
<authorization>
  <deny users="?" />
</authorization>

 I have below code to get user's Display name along with I also want to do validation,

protected void Session_Start(object sender, EventArgs e)
    {

        if (Context.User != null)
        {
            MapUserADDetails(Context.User);
        }
    }

    private void MapUserADDetails(IPrincipal user)
    {

        using (HostingEnvironment.Impersonate())
        using (var domain = new PrincipalContext(ContextType.Domain, "test.com"))
        using (var usr = UserPrincipal.FindByIdentity(domain, user.Identity.Name))
        {
            if (usr == null)
            {
                return;
            }

            Session.Add("UserDisplayName", usr.DisplayName);
        }
    }

 

Now I am hosted this app to IIS with only windows authentication enabled. When I am browsing it, it's prompt for userName and Password, 

Question,

Even I am entering wrong username/password or even doesn't fill anything, it's able to fetch Display Name.

How to restrict this? User/Pass must be validate against the AD. Please suggest. Thanks!

Answer 1

User-693045842 posted

You user iis express or IIS full version ?

Answer 2

User1724605321 posted

Hi ajmaly ,

Please make sure Anonymous Authentication should be disabled, and Windows Authentication enabled in IIS. When apply windows authentication,users are logged in automatically and their identity is stored in the Identity property of the User object. The User object is an instance of the IPrincipal interface. You can get the name of the user from User.Identity.Name. The value returned from this is in the form DomainName\UserName or MachineName\UserName. Please read below articles for details :

http://www.mikesdotnetting.com/article/216/windows-authentication-with-asp-net-web-pages 

http://www.asp.net/mvc/overview/older-versions-1/security/authenticating-users-with-windows-authentication-cs 

Best Regards,

Nan Yu