Use ADS to confirm password

[benvegiard]

This should be simple, but I'm not finding it!

Is there a way to take a username and password and confirm that it is a valid network login by querying ADS?

Thanks,
Ben

 

[theoxyde]

There may be a better way than this... but it's an idea.

Take a look at "Impersonation". I haven't tried this myself, but if you can successfully impersonate that user with credentials supplied by the user... that should indicate that the credentials are valid.

Anyone feel free to correct me if I am mistaken.

 

[younguser]

Try to use WindowsIdentity.GetCurrent method to retrieve user account. From help, you will get more info.

 

[benvegiard]

Well, this is definately getting closer. I implemented the following:

Private Sub Button2_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button2.Click
SSPValidateUser("bvegi", "rubic", "&quot
End Sub

'The following two calls are used for ValidLogin function
<DllImport(&quot;C:\\WINNT\\System32\\advapi32.dll&quot> _
Public Shared Function LogonUser(ByVal lpszUsername As String, ByVal lpszDomain As String, ByVal lpszPassword As String, _
ByVal dwLogonType As Integer, ByVal dwLogonProvider As Integer, ByRef phToken As Integer) As Boolean
End Function

<DllImport(&quot;C:\\WINNT\\System32\\Kernel32.dll&quot> _
Public Shared Function GetLastError() As Integer
End Function


Shared Function ValidLogin(ByVal lsUsername As String, ByVal lsPassword As String) As Boolean
'The Windows NT user token.
Dim token1 As Integer

'The parameters for LogonUser are the user name, computer name, password,
'Logon type (LOGON32_LOGON_NETWORK_CLEARTEXT), Logon provider (LOGON32_PROVIDER_DEFAULT),
'and user token.
Dim loggedOn As Boolean = LogonUser(lsUsername, &quot;&quot;, lsPassword, 3, 0, token1)

'Call GetLastError to try to determine why logon failed if it did not succeed.
Dim ret As Integer = GetLastError()
MsgBox(CStr(ret))
If Not loggedOn Then
Return (False)
Else
Return (ret = 0)
End If
End Function

However, when attempting the LogonUser call, it returns an error of 1134 (no privlidges) which I am assuming means I cannot perform the function as I (the user) do not have admin rights on the server.

This, unfortunately, blocks the impersination idea as well since we have to gain the user token by making this call prior to creating the impersination.

My thoughts are to impersinate the administrator during the routine if I can get around the &quot;get current user token&quot; problem.

ANy thoughts?