Passing login parameters to a web site

[guns1inger]

I have a website that I need to allow access to for a large group of people. Currently, to login the user is propmted for a domain password (it's hosted on an old 2000 server box). The credentials are then passed automatically to the web app because all the users are also AD users. So far, so good.

I have a new group of users who are currently not AD users. There is not reason to make them AD users, unless I cannot get around my current problem.

The plan is to create a single AD login for this group (a common, generic login - putting aside security issues etc), and have these users simply enter their login and password to the web app when prompted. That way we don't have to have them in the AD, just in the web app. This means the login process for this group of users becomes login/password for the AD (generic), then login/password for the Web app (user specific).

We would like to simplify this process by including the generic login in the link, so the user is presented with just the web app login.

Now I have tested this with firefox and IE, using the format http://loginassword@address.com/

It works under firefox (love that app), however IE does not pass these through as credentials. Instead it passes them through as part of the web site address and returns a page not found.

Is there a way to pass the login and password as part of the address in IE so it works the same way as firefox ?

[kschang]

That syntax only works for FTP on IE. I am not aware of a work-around.

In any case, it's extremely unsafe. As HTTP traffic is not encrypted and anyone monitoring that port may be able to read your account and password.

Perhaps make a new group of users under the webserver and give different rights? Hmmm...

[guns1inger]

I have tried to talk to the owners about security etc, and agree it is unsafe. My preference is to maintain them via the AD anyway, so I won't be too disappointed if there is no work around.

[Prot]

You could use ACLs on your router to permit authorized network traffic to the web site. Not as good for individual users, however, since IPs will be assigned dynamically, but it would exclude outside traffic from accessing the web site.

[Krispy Kritter]

This does work in IE also (login/password in the url). It's been awhile so I can't remember exactly, but it seems like a security update in SP2 disabled the "feature". It is a simple registry hack to correct it. I don't have it handy here at work, otherwise I would post it now.

[jimmalenko]

This does work in IE also (login/password in the url). It's been awhile so I can't remember exactly, but it seems like a security update in SP2 disabled the "feature". It is a simple registry hack to correct it. I don't have it handy here at work, otherwise I would post it now.

Something like http://www.rgagnon.com/pbdetails/pb-0249.html ?