title: How can an ASP.NET website authorize using Active Directory Groups without login prompts?
body: <p>I want to build an intranet website that doesn't login-prompt a user that is already logged in to the AD (on a company computer in the same domain as the IIS server). So far, all my attempts have resulted in a basic login prompt or not being able to read HttpContext.User.Identity.Name. The User object would then be used to check if that user is a member of a certain Active Directory group in the domain.</p>
  
  <p>I've seen different solutions that require the user to add a Trusted site in the browser or registry edits. That is not what the product owner would like. <strong>Would it be possible to create a completely automatic experience (the user would have had to log in to their computer anyway)?</strong></p>
  
  <p><strong>MyAuthorizeAttribute</strong></p>
  
  <p>The code below is found inside my custom AuthorizeAttribute that is put on the index method of my home controller. This shouldn't matter though, because it works once there is a User object and the controller is called. Users that are members of the group will continue to the start page, others wont.</p>
  
  <pre><code>            PrincipalContext context = new PrincipalContext(ContextType.Domain, "&lt;domain name&gt;");
  
              UserPrincipal userPrincipal = UserPrincipal.FindByIdentity(context, httpContext.User.Identity.Name);
  
              if (userPrincipal != null)
              {
                  if (userPrincipal.IsMemberOf(context, IdentityType.SamAccountName, "&lt;group name&gt;"))
                  {
                      // The user belongs to the group
                      return true;
                  }
              }
              // The user is not a member of the group, handle the unauthorized request
              return false;
  </code></pre>
  
  <p><strong>Web.config</strong></p>
  
  <pre><code>&lt;authentication mode="Windows" /&gt;    
  &lt;authorization&gt;
    &lt;allow users="*" /&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p><strong>IIS</strong></p>
  
  <p>Site:</p>
  
  <ul>
  <li>Authentication: only Windows enabled (I've tried with anonymous but I can't retrieve any User info)
  <ul>
  <li><em>edit:</em> Provider: NTLM</li>
  </ul></li>
  </ul>
  
  <p>Application Pool: </p>
  
  <ul>
  <li>.NET 4.0.30319</li>
  <li>Integrated</li>
  <li>Identity: Network Service (I've tried app pool as well, but one solution suggested network service)</li>
  </ul>