Using Nav authentication for website login

G8tor

Hi

Im programming ASP.NET website that use Nav 2009 web services. This website needs to have user authentication system that authenticates users with login form at the beginning of the site.
Is it possible for me to do the authentication from the Nav side instead of creating new authentication system in .NET with SQL database and the overhead that comes with it.

My idea is that the login form sends the user and password through Nav codeunit webservice to function that validates the username and password and gives the respond back to the site that the use is authenticated or not. This will save me alot of work in .NET.

Is it possible, how and is there some security issues that I need to be aware of?

deV.ch

Why not using windows credientals? These you can pass to your webservice so therefore you don't need to build such a system, everything should work out of the box.
Also have a look at asp.net membership providers, these are designed for building authentication systems.

Sog

Windowscredentials depends if the projected users for the website are in the domain.

You can use the webservice for user validation. We have such an authentication already running with may of our customers.
Things to take in mind is security. Don't store the passwords plaintext, but use a hash and so. Only give one error: bad username/password combo.
If you start specifying the error for the user, it's not helping him, but potential attackers.

Other security measures also apply, but nothing specific for NAV or webservices

deV.ch

You can use Windows Credentials from outside of the domain too. Like you do it with Outlook webaccess.

Of course using plain text would be very bad idea... You need at least a SSL encryption of your webservice and your website too (IMO). Please consider reading about login machanism etc in the net. There should be tons of articles about it. I definitly recommend codeproject.com for anything related with .net, asp.net, etc.

Sog

deV.ch wrote:

You can use Windows Credentials from outside of the domain too. Like you do it with Outlook webaccess.

Yes, but my point was more that the users might be customers. And there is no way that I would recommend to create a windows user (and profile) for external users...

deV.ch

Of course then you won't use windows authentication but since that was not specified by the OP, i suggested it.
If it's about customers i would definitly use ASP.net Membership Providers, they are designed for that. Don't reinvent the wheel.

G8tor

I think I understand what you are saying.

Thanks for the reply.