How to safely detect users with no authentication












0















I'm looking for solutions, or workarounds, for detecting users accessing my website from within a company network without the need of a user/password login. These users have some unrestricted access to my site.



Came to my mind to check the user's IP against a known IP range or subnetwork, but this does not seems to be the most reliable or secure solution.










share|improve this question























  • A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.

    – Lex Li
    Nov 23 '18 at 14:35











  • Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.

    – NestorArturo
    Nov 24 '18 at 15:21
















0















I'm looking for solutions, or workarounds, for detecting users accessing my website from within a company network without the need of a user/password login. These users have some unrestricted access to my site.



Came to my mind to check the user's IP against a known IP range or subnetwork, but this does not seems to be the most reliable or secure solution.










share|improve this question























  • A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.

    – Lex Li
    Nov 23 '18 at 14:35











  • Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.

    – NestorArturo
    Nov 24 '18 at 15:21














0












0








0








I'm looking for solutions, or workarounds, for detecting users accessing my website from within a company network without the need of a user/password login. These users have some unrestricted access to my site.



Came to my mind to check the user's IP against a known IP range or subnetwork, but this does not seems to be the most reliable or secure solution.










share|improve this question














I'm looking for solutions, or workarounds, for detecting users accessing my website from within a company network without the need of a user/password login. These users have some unrestricted access to my site.



Came to my mind to check the user's IP against a known IP range or subnetwork, but this does not seems to be the most reliable or secure solution.







asp.net-mvc iis networking






share|improve this question













share|improve this question











share|improve this question




share|improve this question










asked Nov 23 '18 at 12:36









NestorArturoNestorArturo

1,94111117




1,94111117













  • A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.

    – Lex Li
    Nov 23 '18 at 14:35











  • Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.

    – NestorArturo
    Nov 24 '18 at 15:21



















  • A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.

    – Lex Li
    Nov 23 '18 at 14:35











  • Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.

    – NestorArturo
    Nov 24 '18 at 15:21

















A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.

– Lex Li
Nov 23 '18 at 14:35





A company network should have its characteristics you can learn from its network administrators. For instance, they might issue internal certificates to all users for client certificate authentication, which you might also use. So it is too broad to discuss here, as nobody here knows their network setup.

– Lex Li
Nov 23 '18 at 14:35













Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.

– NestorArturo
Nov 24 '18 at 15:21





Thank you Lex for your words. I'd also love my clients have this kind of certifications for an easy identifcation. Sadly, I dare to say, none of them have :( Maybe another method not so spoofable like the IP might help.

– NestorArturo
Nov 24 '18 at 15:21












1 Answer
1






active

oldest

votes


















0














We when say safely detect the users ,it means we are authenticating the users in way and then without the need of user/password login makes it tricky.But we can acheive this




All you have to do is enable windows authentication for your website
in IIS.




If we configure windows authentication correctly,you will get following




  • if the website is browsed using IE, mostly the login will be transparent as there will not be any authentication prompt

  • For firefox/crhome,if i remember correctly,there is a flag to enable to make automatic kerberos login in firefox and chrome should automatically login .


enable windows auth in IIS



Normally the windows login prompt works perfectly fine with IE (some settings are needed but those settings can be controlled using domian policies). In case you still get auth prompts ,you just want some kind of authentication,you can have NTLM enabled and no kerberos in IIS settings



If you still get authentication prompt,try enabling just NTLM and check



IIS ->Website->Authentication->Windows Authentication->Providers remove negotiate



remove negotiate from providers



For some reason user cannot be authenticated(user comes from different domain or forest),then an authentication prompt is shown.






share|improve this answer
























  • Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)

    – NestorArturo
    Nov 26 '18 at 20:38












Your Answer






StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});














draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53446842%2fhow-to-safely-detect-users-with-no-authentication%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























1 Answer
1






active

oldest

votes








1 Answer
1






active

oldest

votes









active

oldest

votes






active

oldest

votes









0














We when say safely detect the users ,it means we are authenticating the users in way and then without the need of user/password login makes it tricky.But we can acheive this




All you have to do is enable windows authentication for your website
in IIS.




If we configure windows authentication correctly,you will get following




  • if the website is browsed using IE, mostly the login will be transparent as there will not be any authentication prompt

  • For firefox/crhome,if i remember correctly,there is a flag to enable to make automatic kerberos login in firefox and chrome should automatically login .


enable windows auth in IIS



Normally the windows login prompt works perfectly fine with IE (some settings are needed but those settings can be controlled using domian policies). In case you still get auth prompts ,you just want some kind of authentication,you can have NTLM enabled and no kerberos in IIS settings



If you still get authentication prompt,try enabling just NTLM and check



IIS ->Website->Authentication->Windows Authentication->Providers remove negotiate



remove negotiate from providers



For some reason user cannot be authenticated(user comes from different domain or forest),then an authentication prompt is shown.






share|improve this answer
























  • Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)

    – NestorArturo
    Nov 26 '18 at 20:38
















0














We when say safely detect the users ,it means we are authenticating the users in way and then without the need of user/password login makes it tricky.But we can acheive this




All you have to do is enable windows authentication for your website
in IIS.




If we configure windows authentication correctly,you will get following




  • if the website is browsed using IE, mostly the login will be transparent as there will not be any authentication prompt

  • For firefox/crhome,if i remember correctly,there is a flag to enable to make automatic kerberos login in firefox and chrome should automatically login .


enable windows auth in IIS



Normally the windows login prompt works perfectly fine with IE (some settings are needed but those settings can be controlled using domian policies). In case you still get auth prompts ,you just want some kind of authentication,you can have NTLM enabled and no kerberos in IIS settings



If you still get authentication prompt,try enabling just NTLM and check



IIS ->Website->Authentication->Windows Authentication->Providers remove negotiate



remove negotiate from providers



For some reason user cannot be authenticated(user comes from different domain or forest),then an authentication prompt is shown.






share|improve this answer
























  • Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)

    – NestorArturo
    Nov 26 '18 at 20:38














0












0








0







We when say safely detect the users ,it means we are authenticating the users in way and then without the need of user/password login makes it tricky.But we can acheive this




All you have to do is enable windows authentication for your website
in IIS.




If we configure windows authentication correctly,you will get following




  • if the website is browsed using IE, mostly the login will be transparent as there will not be any authentication prompt

  • For firefox/crhome,if i remember correctly,there is a flag to enable to make automatic kerberos login in firefox and chrome should automatically login .


enable windows auth in IIS



Normally the windows login prompt works perfectly fine with IE (some settings are needed but those settings can be controlled using domian policies). In case you still get auth prompts ,you just want some kind of authentication,you can have NTLM enabled and no kerberos in IIS settings



If you still get authentication prompt,try enabling just NTLM and check



IIS ->Website->Authentication->Windows Authentication->Providers remove negotiate



remove negotiate from providers



For some reason user cannot be authenticated(user comes from different domain or forest),then an authentication prompt is shown.






share|improve this answer













We when say safely detect the users ,it means we are authenticating the users in way and then without the need of user/password login makes it tricky.But we can acheive this




All you have to do is enable windows authentication for your website
in IIS.




If we configure windows authentication correctly,you will get following




  • if the website is browsed using IE, mostly the login will be transparent as there will not be any authentication prompt

  • For firefox/crhome,if i remember correctly,there is a flag to enable to make automatic kerberos login in firefox and chrome should automatically login .


enable windows auth in IIS



Normally the windows login prompt works perfectly fine with IE (some settings are needed but those settings can be controlled using domian policies). In case you still get auth prompts ,you just want some kind of authentication,you can have NTLM enabled and no kerberos in IIS settings



If you still get authentication prompt,try enabling just NTLM and check



IIS ->Website->Authentication->Windows Authentication->Providers remove negotiate



remove negotiate from providers



For some reason user cannot be authenticated(user comes from different domain or forest),then an authentication prompt is shown.







share|improve this answer












share|improve this answer



share|improve this answer










answered Nov 24 '18 at 17:33









RohithRohith

3,54921825




3,54921825













  • Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)

    – NestorArturo
    Nov 26 '18 at 20:38



















  • Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)

    – NestorArturo
    Nov 26 '18 at 20:38

















Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)

– NestorArturo
Nov 26 '18 at 20:38





Thank you for your help. Didn't remember the Kerberos option so gonna give it a shot :)

– NestorArturo
Nov 26 '18 at 20:38




















draft saved

draft discarded




















































Thanks for contributing an answer to Stack Overflow!


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53446842%2fhow-to-safely-detect-users-with-no-authentication%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







這個網誌中的熱門文章

Xamarin.form Move up view when keyboard appear

Post-Redirect-Get with Spring WebFlux and Thymeleaf

Anylogic : not able to use stopDelay()