I have a server that communicates with clients over a .NET socket. I want the se

Question

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group.

The naive way is to send System.Environment.UserName to the server and let it determine the user permissions in this way.

However, it seems to be against best practices since any client can spoof the user name.

Is there an API I can use to send the credentials in a trusted manner to my server application, over a TCP socket?

SSL is not enough, since anyone can establish a secure connection, yet still spoof the username.

Explanation / Answer

In an Active Directory world, assuming that both client and server live in the same domain, then the authentication which occurred on the client can be shown to the server, in a way which will convince the server. This works because an authenticated user on a machine gets a "ticket" which is actually a kind of reference authenticated by the AD server; when the client shows the ticket to the server, the server can show it to its AD server, and the AD server will respond that indeed the ticket is fine. Details can be complex but you can leave all the work to the Microsoft libraries.

If the server-side is an IIS server with ASP.NET, and the client uses .NET, then this is quite simple to configure. If you want to do the work yourself, e.g. by using direct TcpListener and TcpClient, then this will entail, indeed, more work; see the links provided by @makerofthings7.

Note that you will still want to use SSL, to thwart eavesdroppers.

If client and server are not part of the same domain, then things become a bit more complex, because the client application must somehow obtain the right credentials (i.e. the user name and password) for the server's domain, while the application runs in the distinct client's domain. Alternatively, you can use certificate-based client authentication, which can be coupled with SSL; in that case, the client user must have an appropriate certificate and private key installed in his personal certificate store, and the application will use that.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.