Brandon,

Thanks for your reply. I did not know how to use ADSI to retrieve username.
I then looked at the Professinal Active Server Pages 3.0, chapter 21,
Introducing ADSI and Active Directory. The lines on the bottom of page 837
seem to suggest there are some security related problems with using the ADSI
authentication. I am confused. Please let me know if I misunderstand the
meaning in the paragraph on that page.

Thanks,

Xuehua.

----- Original Message -----
From: "Brandon" <patricrat@h...>
To: "Security_asp" <security_asp@p...>
Sent: Wednesday, May 09, 2001 5:08 PM
Subject: [security_asp] Re: which method is more reliable to get NT user
account


> Actually Xuehua, why not try using ADSI (Active Directory) to retrieve
> username. Assuming you have a Windows 2000 based network ADSI provides you
> with extreme extensibility (say if you need to retrieve the groups' that
> the user belongs to), it's considerably easier than developing an MTS
> comp, and it is fairly reliable. Additionally, I have found that the logon
> user environment variable is incredibly unreliable, and will only work if
> you set IIS Authentication to NTFS.
>
> Best Regards,
>
> Brandon Osborne
> US Dept of Defense
> hr90215@d...
> > Hi,
> >
> > I used the following two ways to get the NT user account, who requesting
> a
> > web page, when the web site is set to NT challenge/response only:
> >
> > 1. use the Request.SeverVariables(logon_user)
> > 2. create a non-transactional MTS component, then use the method of the
> > ObjectContext object, i.e. ObjectContext.Security.GetDirectCallerName to
> > retrive the NT user account.
> >
> > Both give the same results. However, it seems to me that the first one
> get
> > the information from the client machine's environment variables, and if
> a
> > hacker changed the environment variables, the Request.SeverVariables
> > (logon_user) may give wrong information. Would the second way, i.e.
> > ObjectContext.Security.GetDirectCallerName gives more reliable NT user
> > account?
> >
> > As I do not know the exact mechanism behind the two methods, anybody can
> > comment on the two methods?
> >
> > Thanks,
> >
>
> ---
> http://www.asptoday.com - the leading site for timely,
> in-depth information for ASP developers everywhere.
$subst('Email.Unsub')
>