title: Better approach for SSO to cater windows integrated auth as well as users not on domain
body: <p>This may be a duplicate(not sure), but since I am unable to quench my thirst for the right answer (0: so here it goes:</p>
  
  <p>I have to provide single signon for my asp.net web application. Where:</p>
  
  <p><strong>Case 1.</strong> User is allowed to login without credentials, if the user is already on domain (logged on windows domain).</p>
  
  <p><strong>Case 2.</strong> User is allowed to login if the user is not on domain, by asking/validating the user login credentials from active directory.</p>
  
  <p><strong>Question 1a.</strong> I would be interested in the comments about the steps that I "am following" and "should follow" to achieve the requirement. How can I improve this? Improve meaning, is this the right way/approach of providing the above required functionality?</p>
  
  <p><strong>Question 1b.</strong> Also, currently I have hard coded roles in my database; I am planning to move it within the active directory user roles; so that I could use .IsInRole method functionality. What do you think about that?</p>
  
  <p>Right now, I have implemented it in the following way. </p>
  
  <p><strong>For case 1, the application uses:</strong>
  Windows authentication; basically like following:</p>
  
  <pre><code>return ((WindowsIdentity)(HttpContext.Current.User.Identity)).IsAuthenticated;
  </code></pre>
  
  <p>The application proceeds if its an authenticated user.</p>
  
  <p><strong>For case 2, the application:</strong>
  Provides page that asks for domain name, user id, and password.
  Checks if the user exists on active directory; following is a snip.</p>
  
  <pre><code>DirectorySearcher search = new DirectorySearcher(entry);
  search.Filter = "(SAMAccountName=" + username + ")";
  search.PropertiesToLoad.Add("cn");
  SearchResult result = search.FindOne();
  </code></pre>
  
  <p>The application proceeds if it finds a record of the user.</p>
  
  <p>Please note that this includes the changes recommended in the web.config file, like following snip:</p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms  loginUrl="~/UI/Pages/Login.aspx" defaultUrl="Default.aspx"  name="adAuthCookie" timeout="60" path="/" /&gt;
  &lt;/authentication&gt;
  
  &lt;authorization&gt;
    &lt;deny users="?"/&gt;
    &lt;allow users="*"/&gt;
  &lt;/authorization&gt;
  &lt;identity impersonate="true"/&gt;
  </code></pre>
  
  <p>Seems like adding roles(admin, supervisor, guest) to active directory roles is much better, but then when I would deploy my application how would I go about adding those hard coded roles in active directory? Well.. just thinking out loud.</p>