Get machine login info using ASP .NET?

[clamum]

Well I have an update. As it turns out, I won't need the user's password. Just whatever username they used to log into the machine with.

The problem is getting. The code I wrote so far only gets the ASPNET account, and when I turn Impersonate on, I get IUSR_<machinename>. But what I need is the actual username that the current user is logged on with (for example, ACarlson for me on this machine).

Is that possible? I sort of need it explicitly (as a String) because the validation checks that String against a local database and/or Active Directory.

Any help would be greatly appeciated.

 

[KLin]

http://www.webmasterworld.com/forum47/2829.htm

EDIT: I don't think you can retrieve their password though, just the username that is currenty logged into the PC.

 

[Atheus]

I don't think you can retrieve their password though, just the username that is currenty logged into the PC

You can dump the LM hash though, a la pwdump, and match it to a hash in the database.

 

[clamum]

Originally posted by: Atheus

I don't think you can retrieve their password though, just the username that is currenty logged into the PC

You can dump the LM hash though, a la pwdump, and match it to a hash in the database.

Really? Awesome. I'll do some reading, thanks a million man.

 

[clamum]

Well I have an update. As it turns out, I won't need the user's password. Just whatever username they used to log into the machine with.

The problem is getting. The code I wrote so far only gets the ASPNET account, and when I turn Impersonate on, I get IUSR_<machinename>. But what I need is the actual username that the current user is logged on with (for example, ACarlson for me on this machine).

Is that possible? I sort of need it explicitly (as a String) because the validation checks that String against a local database and/or Active Directory.

Any help would be greatly appeciated.

 

[Snapster]

If you want to get the logged in user, you need to turn on integrate windows authentication on the application dir in IIS and not use identity impersonate. Then you can use Request.ServerVariables["LOGON_USER"] to get the current logged in user, so you can validate against active directory etc anyway, pretty common for company intranets.

 

[clamum]

Originally posted by: Snapster
If you want to get the logged in user, you need to turn on integrate windows authentication on the application dir in IIS and not use identity impersonate. Then you can use Request.ServerVariables["LOGON_USER"] to get the current logged in user, so you can validate against active directory etc anyway, pretty common for company intranets.

I LOVE YOU

Haha, seriously you made my day man. Thanks a lot. Dunno why I couldn't find that in my trillion Google searches. I tended to focus on the WindowsPrincipal object I guess, though.

Just as a side note, for anyone else that may be interested, at first it returned a blank string. I turned off "Allow Anonymous Access" (just in the Web.config file rather than IIS) and she worked.

 

[torpid]

Yeah, turn off anonymous and just get the User.Identity.Name