Windows Authentication - How to Deny Users using Code

Question

My Windows Authentication is working with IIS7 but now i want to deny specific users based on the data that i have in SQL server.

I know i can send a information access denied but i want to send windows login form to the user to enter different credentials, so that IIS can authenticate the new credentials and send it to the c# to authorize the user again.

Edit - To rephrase the question

I want to use both windows authentication and authentication based on database data. First i want the users to be authenticated via Windows authentication and then application will authenticate the user. But my question is if the application denies the user then I want the Windows authentication dialog box to show up to the user for windows credentials to start the process from beginning.

Did I get it right, you do not want to use Windows Authentication (domain users), but just data from a database to validate users? Or a mixture of both? — Kai Hartmann
@ Kai Hartmann I want the mixture of both. I want to validate users with Windows authentication and then i will do the authentication based on data from database but if i deny a user then i want the browser to ask for different windows credentials and process starts from beginning — Sabareesh Kkanan
@Kai I prefer not to use third party modules in authentication — Sabareesh Kkanan
I agree, I thought the article might provide some hints how to approach the issue. But I think this might help: The article in the following link describes how to use forms authentication, and impersonate a domain user on server side. The credentials of that user are checked against the windows system. So it uses forms authentication with using domain users. visualstudiomagazine.com/articles/2004/05/01/… — Kai Hartmann

Kai Hartmann Kai Hartmann · Accepted Answer · 2013-08-06T12:34:45

If you want to authenticate by using information from a database, you would have to use forms authentication. The steps you have to take are:

Build a Login-Webpage (login.aspx in this example)
Put this in your web.config, to specify the login page and deny access for all users initially:

Code:

<authentication mode="Forms">
  <!-- Login.aspx is the login page forms authentication should use. -->
  <forms loginUrl="Login.aspx" name=".ASPXFORMSAUTH" timeout="30" slidingExpiration="true" >
  </forms>
</authentication>
<authorization>
  <!-- deny all users access to ressources of this app, if not logged in. -->
  <deny users="?" />
</authorization>

In your login page, in code behind, call this to let a user pass:

Code:

FormsAuthentication.SetAuthCookie("UserName", False)

Windows Authentication - How to Deny Users using Code

2 Answers