Windows Session Authentication

Question

Windows Session Authentication

S Abijith 471

Hello All,

We have a Windows application built on .Net Framework 4.8. This application provides a login window was until now being handled by an SQLite database.

But now we would want to implement 'Windows Session Management'. We must also get the role of the logged in Windows user as we have a few features that must be available for only for a particular user type.

Can anyone help us on this??

Any help is highly appreciated. Thank you in advance!!

Accepted answer

0 additional answers

Your answer

Answer 1

Anonymous

Hi @S Abijith , Welcome to Microsoft Q&A,

You can use Windows Authentication to get the currently logged in Windows user. You can use Environment.UserName or WindowsIdentity.GetCurrent() to get the username of the currently logged in user.

using System.Security.Principal;

string currentUser = Environment.UserName;
// or
WindowsIdentity identity = WindowsIdentity.GetCurrent();
string userName = identity.Name;

Windows user roles can be managed through Windows groups. Using WindowsPrincipal and WindowsIdentity, you can determine whether a user belongs to certain Windows groups, such as the Administrators group. Here is the sample code:

using System.Security.Principal;

WindowsIdentity identity = WindowsIdentity.GetCurrent();

WindowsPrincipal principal = new WindowsPrincipal(identity);

// Check if the user is an administrator
bool isAdmin = principal.IsInRole(WindowsBuiltInRole.Administrator);

// You can use a custom role name to check if it belongs to a specific group
bool isSpecificRole = principal.IsInRole("YourCustomRoleName");

Based on the obtained user role or Windows group information, you can restrict access to various functions of the application.

Best Regards,

Jiale

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

S Abijith 471 Reputation points

2024-11-11T10:00:58.7333333+00:00

Hello @Anonymous ,

Thank you for your response!!

We are clear on the first part about trying to login the Windows User.

But we have a doubt regarding fetching user role.

In your answer, we can see:

// You can use a custom role name to check if it belongs to a specific group bool isSpecificRole = principal.IsInRole("YourCustomRoleName");

Can you please let us know as to how we can add our own 'Custom Role'?
Anonymous

2024-11-12T05:34:15.66+00:00

In Windows, each user can belong to one or more groups (groups are also called roles). By checking whether a user belongs to a group, you can control the functional access rights of your application. In Windows, you can create custom groups (for example, "Managers", "Editors", etc.). Assume that you have created a group called YourCustomRoleName in Windows and added the user to the group.

You can use the WindowsPrincipal class to check whether the current user belongs to this specific group. That is, use the above code.
S Abijith 471 Reputation points

2024-11-13T08:51:08.1433333+00:00

Hello @Anonymous ,

Thank you for your response.

Is there any way to use 'Username' and 'Password' for login using Windows Session Authentication??

This is because, we want to validate both the username and password before providing access to the application.

Can you please let us know??

Thank you!!

Anonymous

Maybe you can use LogonUser API to verify username and password.

using System;
using System.Runtime.InteropServices;
using System.Security.Principal;

public class WindowsSessionAuthenticator
{
    //Import the LogonUser function of Windows
    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
    private static extern bool LogonUser(
        string lpszUsername,
        string lpszDomain,
        string lpszPassword,
        int dwLogonType,
        int dwLogonProvider,
        out IntPtr phToken);

    [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
    private extern static bool CloseHandle(IntPtr handle);

   // Define constants for LogonType
    private const int LOGON32_LOGON_INTERACTIVE = 2;
    private const int LOGON32_PROVIDER_DEFAULT = 0;

    // Verify that the username and password are valid
    public static bool ValidateCredentials(string username, string password, string domain = "")
    {
        IntPtr tokenHandle = IntPtr.Zero;

        // Call LogonUser to check the credentials
        bool isValid = LogonUser(username, domain, password, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, out tokenHandle);

        if (isValid)
        {
            // If the login is successful, release the token handle
            CloseHandle(tokenHandle);
        }

        return isValid;
    }
}

S Abijith 471 Reputation points

2024-11-13T09:53:16.1566667+00:00

Hello @Anonymous ,

Thank you for your quick response.

Is there any way to achieve the same without the use of Native methods?
Anonymous

2024-11-14T07:59:13.9433333+00:00

Without using native methods such as LogonUser, it is difficult to implement similar Windows credential-based authentication functionality because the .NET Framework itself does not provide a direct API to verify usernames and passwords.
S Abijith 471 Reputation points

2024-11-20T06:49:49.8+00:00

Thank you for your help @Anonymous .

Share via

Windows Session Authentication

0 additional answers

Your answer