Develop Reference

How to get currently Windows logged User Credentials?

I am working on an ASP.NET Core 2.0 web app. It has it's login and own User interface.
I am trying to retrieve Windows logged users' credentials - like user name, email and password. On login in app, the logged in user's credentials are set as the User. So I need to retrieve windows logged in user's info before login process. I tried the following :
// If domain is example.com, DomainName gives EXAMPLECOM. Plus can't access Password
string evnName = Environment.UserDomainName + Environment.UserName;
In HomeController (after login) and Startup, I tried
// User is null
string userName = this.User.FindFirst(ClaimTypes.Name)?.Value;
I tried the above in a Service where login process is processed. Can't get from their too.
The main reason to retrieve this is to identify if the user has privileges for SMTP access or not, if so set SMTP.
Can anyone please help me know, how can I retrieve Windows Logged User's credentials somehow before Login process.
Thanks a lot.

You can get the current Windows user credentials by using the System.Net.CredentialCache.DefaultCredentials static property.
You won't be able to get the password as that would be a major security hole. You should be able to get everything else you want out of that, however.

How to get username and password of windows authentication from code

I need to pass WINDOWS AUTHENTICATION details of logged in user to the pdf converter to make it work.
I've tried this
PdfConverter.AuthenticationOptions.Username = CredentialCache.DefaultNetworkCredentials.UserName;
PdfConverter.AuthenticationOptions.Password = CredentialCache.DefaultNetworkCredentials.Password;
But this doesn't help. Converter is working locally, but returning 404 errors in the server where windows authentication is enabled.
How can I get credentials with the code?

Try this:- (You can use WindowsIdentity)
WindowsIdentity id = HttpContext.Current.Request.LogonUserIdentity;
String UserName = id.Name;
I don't think we can retrieve password since passwords are not stored in Windows.

You should upgrade to the latest version which uses the credentials of the current Windows to access the web page from IIS. This can be disabled if you want with HtmlToPdfConverter.AuthenticationOptions.UseDefaultCredentials property

Log AD users in

I have a login form written in C# and I want only AD users to be able to login.
How should I do this?
string UserName = "";
string Pass = "";

Although it is not an ASP.Net app the active directory membership provider will work just fine.
Here is info on how to use this library:
http://msdn.microsoft.com/en-us/library/system.web.security.activedirectorymembershipprovider.aspx
and here is some more information:
http://msdn.microsoft.com/en-us/library/ff650308.aspx

I am sure that this is not a best practice, but, depending on your security needs, you could allow all domain users and exclude local users by checking just the UserDomainName in the Form_Load. This simple approach piggybacks on their computer login, and does not have the complexity of any LDAP/AD calls.
if (SystemInformation.UserDomainName.ToString() == "myDomain")
{
// your normal form load code here
}
else
{
form1.Close(); //this is a simple but effective to pull the rug out from
//under them if they do not have the permissions
//TODO email the application administrator the `SystemInformation.UserName` of the user who was not given permissions
}
In my environment, since our in-house apps are deployed via ClickOnce (installed per user per computer), a similar approach (we compare usernames too) has always been sufficient for us.

If you want to know how to verify credentials to Active Directory in order to allow AD users in you application, you should check this.
You'll find how to verify the content of your textboxes and verify if username and passowrd matches (directly with the AD).

Check if a user is already logged into domain with System.DirectoryServices.AccountManagemen

C# or VB.NET suggestion is welcome.
I have computers joined to a domain. I'm writing a desktop application that ask for a username and password to authenticate user against Active Directory.
Sometimes, user uses this application on the computer that is not joined to the domain.
I'm using .NET 3.5, System.DirectoryServices, and System.DirectoryServices.AccountManagement. Code sample how to authenticate users:
Private Function ValidateExternalUser(ByVal username As String, ByVal password As String) As Boolean
Using context As PrincipalContext = New PrincipalContext(ContextType.Domain, "your_domain_here")
Return context.ValidateCredentials(username, password, ContextOptions.Negotiate)
End Using
End Function
' from http://stackoverflow.com/questions/30861/authenticating-domain-users-with-system-directoryservices
I want to know how to check if user is already logged in on domain computer, then I don't have to ask them log into the application again.
Update
If it can't be done with System.DirectoryServices.AccountManagemen, is there any way to do it? Thanks

If the machine is not attached to the domain, then the System.Environment.DomainName property will be equal to the System.Environment.MachineName.

I don't think you can do that with the S.DS.AM namespace. Knowing whether or not a user is logged into a domain would be something that needs to be handled on the domain controller at runtime - S.DS.AM is concerned with static information (user's properties), not really dynamic runtime properties (who's logged in).

I checked System.Security.Principal.WindowsIdentity.GetCurrent.Name , and it gives me
"domain\username"
With that information and System.Security.Principal.WindowsIdentity.GetCurrent.IsAuthenticated , I think I get what I want.

How to search Active Directory when dialed in remotely?

Is there a way to use a credential coming from the user's saved password list and use that instead of the local Windows credentials?
I need to look up a user's email address based on their Active Directory username to allow them to register for email updates via an intranet site. This seems easy enough if the user is actually logged into a machine directly that's part of the domain - I can use their identity name to search the AD based on their username:
using( DirectoryEntry root = new DirectoryEntry("LDAP://admachine.domain.local") )
{
using( DirectorySearcher searcher = new DirectorySearcher(root) )
{
// strip the domain from the username and find the user in AD
var username = Regex.Replace(Page.User.Identity.Name, #".*\\", string.Empty);
searcher.ReferralChasing = ReferralChasingOption.All;
searcher.SearchScope = SearchScope.Subtree;
searcher.Filter = string.Format("(&(objectCategory=user)(objectClass=person)(sAMAccountName={0}))", username);
var foundUser = searcher.FindOne();
// error checking occurs here...
var email = foundUser.Properties["mail"][0].ToString();
// TODO: stuff with the email address
}
}
However, if working from a PC at home this doesn't work. Page.Identity.Name resolves to the name I'm logged onto my own PC (MyMachine\Dave), ignoring stored credentials I used to authenticate with my work domain (WorkDomain\dave.downs).
The DirectoryEntry picks up and uses the saved credential just fine, allowing me to actually bind to and search the AD, but I can't find a way of then using it as the var username, which will contain of my local machine username instead.
Is there a way to actually do what I'm trying to do, or am I just going about things the wrong way/hitting my head against a brick wall?

I assume you are using IIS. Disable Anonymous Access and enable windows authentication. That way anybody who is not in the domain will get a popup that allows them to specify their domain user and password. For users that are coming from a domain enabled server nothing changes. But that way you guarantee that the identity will always resolve to a valide domain user. So this should solve your "I am seeing a non-domain user" problem. Check Windows Authentication Provider for details.

If they are logged in via Windows Auth, you can use:
System.Security.Principal.WindowsIdentity.GetCurrent().User
which will give you the sid of the logged in user.
Disable anonymous access and integrated security in IIS, force them to log in via basic auth under https. This will give make sure the the current session is running under an authenticated domain user.