How to safely detect users with no authentication
I'm looking for solutions, or workarounds, for detecting users accessing my website from within a company network without the need of a user/password login. These users have some unrestricted access to my site.
Came to my mind to check the user's IP against a known IP range or subnetwork, but this does not seems to be the most reliable or secure solution.
asp.net-mvc iis networking
asked Nov 23 '18 at 12:36
NestorArturoNestorArturo
1,92611117
add a comment |
I'm looking for solutions, or workarounds, for detecting users accessing my website from within a company network without the need of a user/password login. These users have some unrestricted access to my site.
Came to my mind to check the user's IP against a known IP range or subnetwork, but this does not seems to be the most reliable or secure solution.
asp.net-mvc iis networking
asked Nov 23 '18 at 12:36
NestorArturoNestorArturo
1,92611117
A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.
– Lex Li
Nov 23 '18 at 14:35
Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.
– NestorArturo
Nov 24 '18 at 15:21
add a comment |
I'm looking for solutions, or workarounds, for detecting users accessing my website from within a company network without the need of a user/password login. These users have some unrestricted access to my site.
Came to my mind to check the user's IP against a known IP range or subnetwork, but this does not seems to be the most reliable or secure solution.
asp.net-mvc iis networking
asked Nov 23 '18 at 12:36
NestorArturoNestorArturo
1,92611117
I'm looking for solutions, or workarounds, for detecting users accessing my website from within a company network without the need of a user/password login. These users have some unrestricted access to my site.
Came to my mind to check the user's IP against a known IP range or subnetwork, but this does not seems to be the most reliable or secure solution.
asp.net-mvc iis networking
asp.net-mvc iis networking
asked Nov 23 '18 at 12:36
NestorArturoNestorArturo
1,92611117
asked Nov 23 '18 at 12:36
NestorArturoNestorArturo
1,92611117
asked Nov 23 '18 at 12:36
NestorArturoNestorArturo
1,92611117
asked Nov 23 '18 at 12:36
NestorArturoNestorArturo
1,92611117
asked Nov 23 '18 at 12:36
NestorArturoNestorArturo
1,92611117
1,92611117
A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.
– Lex Li
Nov 23 '18 at 14:35
Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.
– NestorArturo
Nov 24 '18 at 15:21
add a comment |
A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.
– Lex Li
Nov 23 '18 at 14:35
Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.
– NestorArturo
Nov 24 '18 at 15:21
A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.
– Lex Li
Nov 23 '18 at 14:35
A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.
– Lex Li
Nov 23 '18 at 14:35
Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.
– NestorArturo
Nov 24 '18 at 15:21
Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.
– NestorArturo
Nov 24 '18 at 15:21
add a comment |
1 Answer
1
active
oldest
votes
We when say safely detect the users ,it means we are authenticating the users in way and then without the need of user/password login makes it tricky.But we can acheive this
All you have to do is enable windows authentication for your website
in IIS.
If we configure windows authentication correctly,you will get following
- if the website is browsed using IE, mostly the login will be transparent as there will not be any authentication prompt
- For firefox/crhome,if i remember correctly,there is a flag to enable to make automatic kerberos login in firefox and chrome should automatically login .
Normally the windows login prompt works perfectly fine with IE (some settings are needed but those settings can be controlled using domian policies). In case you still get auth prompts ,you just want some kind of authentication,you can have NTLM enabled and no kerberos in IIS settings
If you still get authentication prompt,try enabling just NTLM and check
IIS ->Website->Authentication->Windows Authentication->Providers remove negotiate
For some reason user cannot be authenticated(user comes from different domain or forest),then an authentication prompt is shown.
answered Nov 24 '18 at 17:33
RohithRohith
3,43421823
Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)
– NestorArturo
Nov 26 '18 at 20:38
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53446842%2fhow-to-safely-detect-users-with-no-authentication%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
We when say safely detect the users ,it means we are authenticating the users in way and then without the need of user/password login makes it tricky.But we can acheive this
All you have to do is enable windows authentication for your website
in IIS.
If we configure windows authentication correctly,you will get following
- if the website is browsed using IE, mostly the login will be transparent as there will not be any authentication prompt
- For firefox/crhome,if i remember correctly,there is a flag to enable to make automatic kerberos login in firefox and chrome should automatically login .
Normally the windows login prompt works perfectly fine with IE (some settings are needed but those settings can be controlled using domian policies). In case you still get auth prompts ,you just want some kind of authentication,you can have NTLM enabled and no kerberos in IIS settings
If you still get authentication prompt,try enabling just NTLM and check
IIS ->Website->Authentication->Windows Authentication->Providers remove negotiate
For some reason user cannot be authenticated(user comes from different domain or forest),then an authentication prompt is shown.
answered Nov 24 '18 at 17:33
RohithRohith
3,43421823
Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)
– NestorArturo
Nov 26 '18 at 20:38
add a comment |
We when say safely detect the users ,it means we are authenticating the users in way and then without the need of user/password login makes it tricky.But we can acheive this
All you have to do is enable windows authentication for your website
in IIS.
If we configure windows authentication correctly,you will get following
- if the website is browsed using IE, mostly the login will be transparent as there will not be any authentication prompt
- For firefox/crhome,if i remember correctly,there is a flag to enable to make automatic kerberos login in firefox and chrome should automatically login .
Normally the windows login prompt works perfectly fine with IE (some settings are needed but those settings can be controlled using domian policies). In case you still get auth prompts ,you just want some kind of authentication,you can have NTLM enabled and no kerberos in IIS settings
If you still get authentication prompt,try enabling just NTLM and check
IIS ->Website->Authentication->Windows Authentication->Providers remove negotiate
For some reason user cannot be authenticated(user comes from different domain or forest),then an authentication prompt is shown.
answered Nov 24 '18 at 17:33
RohithRohith
3,43421823
Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)
– NestorArturo
Nov 26 '18 at 20:38
add a comment |
We when say safely detect the users ,it means we are authenticating the users in way and then without the need of user/password login makes it tricky.But we can acheive this
All you have to do is enable windows authentication for your website
in IIS.
If we configure windows authentication correctly,you will get following
- if the website is browsed using IE, mostly the login will be transparent as there will not be any authentication prompt
- For firefox/crhome,if i remember correctly,there is a flag to enable to make automatic kerberos login in firefox and chrome should automatically login .
Normally the windows login prompt works perfectly fine with IE (some settings are needed but those settings can be controlled using domian policies). In case you still get auth prompts ,you just want some kind of authentication,you can have NTLM enabled and no kerberos in IIS settings
If you still get authentication prompt,try enabling just NTLM and check
IIS ->Website->Authentication->Windows Authentication->Providers remove negotiate
For some reason user cannot be authenticated(user comes from different domain or forest),then an authentication prompt is shown.
answered Nov 24 '18 at 17:33
RohithRohith
3,43421823
We when say safely detect the users ,it means we are authenticating the users in way and then without the need of user/password login makes it tricky.But we can acheive this
All you have to do is enable windows authentication for your website
in IIS.
If we configure windows authentication correctly,you will get following
- if the website is browsed using IE, mostly the login will be transparent as there will not be any authentication prompt
- For firefox/crhome,if i remember correctly,there is a flag to enable to make automatic kerberos login in firefox and chrome should automatically login .
Normally the windows login prompt works perfectly fine with IE (some settings are needed but those settings can be controlled using domian policies). In case you still get auth prompts ,you just want some kind of authentication,you can have NTLM enabled and no kerberos in IIS settings
If you still get authentication prompt,try enabling just NTLM and check
IIS ->Website->Authentication->Windows Authentication->Providers remove negotiate
For some reason user cannot be authenticated(user comes from different domain or forest),then an authentication prompt is shown.
answered Nov 24 '18 at 17:33
RohithRohith
3,43421823
answered Nov 24 '18 at 17:33
RohithRohith
3,43421823
answered Nov 24 '18 at 17:33
RohithRohith
3,43421823
answered Nov 24 '18 at 17:33
RohithRohith
3,43421823
3,43421823
Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)
– NestorArturo
Nov 26 '18 at 20:38
add a comment |
Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)
– NestorArturo
Nov 26 '18 at 20:38
Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)
– NestorArturo
Nov 26 '18 at 20:38
Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)
– NestorArturo
Nov 26 '18 at 20:38
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53446842%2fhow-to-safely-detect-users-with-no-authentication%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.
– Lex Li
Nov 23 '18 at 14:35
Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.
– NestorArturo
Nov 24 '18 at 15:21