Hi,
I would like to develop a Visual C++ application which will allow my users
to enter it directly without login screen in case the user has already
logged on into a AD domain. I believe this is called: "single sign-on".
The requirements for authentication module are:
a. a user is identified by "domain/username" and "password" strings.
b. application imports in own database a list of users from AD which are
allowed to enter the application.
c. if the user is already authenticated (logged on to a domain) in Windows
and the user is allowed to enter the application, my application should not
prompt for password.
d. if the user is not logged on in a Windows domain (for example if he uses
local computer log on), my application should detect this and then prompt
for "domain/username" and "password". Credentials are validated first
against own database and afterwards they will be checked in supplied AD
domain. If both steps are successful, then the user can start the
application.
What are your opinions regarding the steps detailed above? Is this a logical
way to see things?
And now my most stringent questions ...
1. Using C++, how do I detect if current user is logged on, then if he is
logged on in
a Windows domain?
2. Can I rely on some information supplied by Windows about current user in
order to be sure that the user is not faking access? For example, can obtain
from OS current credentials (without entering again or passing passwords)
and validate them in AD?
I would like to do something similar to what MS SQL Server does with
authentication and security for an operating system user. I mean if my login
is designated to use Windows user, then SQL Server does not prompts for
credentials.
Thanks very much!
Robert