We have an Active Directory forest with one parent domain and two child domains.  I am using Windows authentication for our staff intranet with the latest version of mojoPortal running on SQL/IIS.

The problem that I am experiencing is that I don't want users to be automatically added to the mp_Users.  In particular users from the child domains should absolutely not be getting added to the database.  Here is the authorization section of web.config:

<authentication mode="Windows" />

<authorization>
   <allow roles="parentdomain\domain users" />
   <deny roles="childdomain1\domain users" />
   <deny roles="childdomain2\domain users" />
   <deny users="?" />
   </authorization>

I'm finding that if users from the child domain are logged onto a computer within our network and try and access the mojo site they get added to the database automatically.  If they try and access the site through a browser on a computer outside of our domain (e.g. from home) they don't get added to the database.

I don't really even want to allow parent domain users to be automatically added.

Any ideas as to what is wrong with my setup?

Thanks, Rob

Hi Joe,

We published our website a week ago using this authentication method and it is no problem logging on from outside our network (not LAN or VPN).  The box "Use LDAP Authentication" is clearly unchecked.

I have developed a SQL script to load users from our Active Directory in to mp_Users.

Thanks,

Rob

In my testing this scenario works with all major browsers.  From outside our network Chrome, Firefox, IE prompt for credentials and users can successfully login.  From inside the network IE passes credentials right in.  So it is perfect for our staff intranet.

I understand that each user needs an entry in mp_Users which is why I was doing it through a SQL load.  I would like to know how to prevent the automatic entry in the Windows Authentication scenario.  The major problem is that our child domain users are not allowed access to the website, but are considered Authenticated Users on our network.  The LDAP security model has the option to uncheck "Automatically Add LDAP users on first login?".  I was hoping for the same thing with Windows.  Could this be an enhancement request?

I thought I could change the  <deny users="?" />  to  <deny users="*" /> and that if users weren't in the allowed roles entries that it would deny them.  I've done this on other asp.net apps.  But when I use the asterisk instead of the question mark on mojoPortal it kills all access.

Just to be clear.  The child domain users are getting denied entry to the site, but are getting inserted into the database.

Thanks again,

Rob