yeah it doesn't have a way to know the user's email address, we could possibly make an assumption there that the email is user@domain.com but that would likely be a false assumption in many cases.

I'll look into making a config option that could enable you to confirm the assumption and make it do that.

Best,

Joe

There is no way I can make it perfect, if you use more than one scheme for your own users then no matter what I do it will guess wrong for some users.

Here is what I'm implementing for the next version:

private string GuessEmailAddress(string userName)
        {
            if (WebConfigSettings.GuessEmailForWindowsAuth)
            {
                if (userName.Contains("/"))
                {
                    string domain = userName.Substring(0, userName.IndexOf("/"));
                    string user = userName.Replace(domain, string.Empty).Replace("/", string.Empty);
                    return user + "@" + domain + WebConfigSettings.WindowsAuthDomainExtension;
                }
            }

            return string.Empty;
        }

Where WindowsAuthDomainExtension will default to .com

Best thing to do would be to tell users they need to update their email address under My Account the first time they use the site.

Best,

Joe

Hey Joe,

Just reviewing this thread and I noticed you may be using the wrong slash in your code. You're using a forward slash (/) for the domain separator but a back slash (\) should be used.

Thanks,
Joe D.

The SSO works perfectly when I go to http://servername but when I browse to http://servername.domain.com it always asks for the logon. Any ideas?

Windows Authentication only works on a local network not on the internet. If servername.domain.com maps to a public internet ip address it will not work.

I would not recommend using Windows authentication for a site that has a public facing ip address on the internet, it should only be used on a local network/intranet. 

Users on your local network should connect over the local network not the public ip address. I'mnot positive but by exposing your site on the internet you "may" be giving hackers an opportunity for dictionary attacks to guess actual domain user credentials because IE will keep prompting until valid credentials are given.

http://msdn.microsoft.com/en-us/library/ee825205%28CS.10%29.aspx