ADP's + Windows NT Auth + U/P Prompt

[adversus]

I have an existing ADE (Access Data Project compiled) project that has been in use in a production environment for nearly 3 years, and has been working great. It's been working so great, in fact, that my client is asking me to look at porting it over to another take the place of another system.

In going through their requirements, one line caught my attention. The current port of the project uses the Windows NT Authentication method to connect to the SQL Server, and uses a user's table to see if the user opening the project is a valid application user.

The "new port" they are asking for requires that the user enter in their Windows login/password (which is managed by an Active Directory LDAP server). I've never, ever, had a client ask for a Windows authenticated system to prompt for the same username/password again before opening the app. I'm not even sure ADP applications can do this with the way they use OLE to connect to the SQL Server.

I've searched around a bit today and haven't found a clear answer. Can anybody shed some insight?

[Stewart Ross]

Hi. As you rightly point out, your client seems to be confusing things a little here. To be able to run the application at all the user has to log in via the LDAP authentication. Once this hurdle is cleared the system 'knows' who the user is, and you could use system routines to return the username to Access so that you can continue to use the existing user table and custom login routines to provide custom access to the application.

If you are being asked to authenticate users a second time from Access the only real advantage I can see is that you are guarding against other non-authorised persons running the application while the logged-in user has slipped away from the workstation for a while. As you also point out, this has nothing at all to do with connecting to the SQL server back-end - it is still a user authentication task, not a connection one.

It is certainly possible to use windows API code from Access to query the LDAP server and return the username, ask for a password, and authenticate the user accordingly. If you do a Google search for such code you will find examples that could help you in VB and other languages.

I have used commercial applications which do require such enter-again authentication using LDAP, and these have pre-filled the user's log-in ID (obtained from the LDAP server) in the application's user authentication window, just leaving the password to be entered. It is not uncommon to have to re-authenticate the existing user, although its benefits in your clients particular case are unclear.

Well done for developing an application that your client is keen to develop further! I hope the project goes smoothly for you.

-Stewart

[adversus]

Thanks for the reply!

I'm waiting to find out today if the reason they want a separate login is so that a different user other than the logged in system user can open it. If that's the case, it opens up a whole new ball of wax and delves into Windows Impersonation etc.

I got a solution using SSPI to manually verify user credentials against the domain, so if they're fine with that, it'll be an easy solution :)