DotNetNuke Mixed Mode Authentication

This part of the project is going very well so far. We now have DotNetNuke attempting a Windows authentication via an ASPX page through IIS Integrated Windows Authentication option. If we get a good access token we log the user into requested portal. Since we are deploying this as a single site with many sub-portals, we ensure that when we log the user in that they have a UserPortal record for every portal on this instance. This allows one user account to access multiple portals.

There are still two items on the todo list:

1. DNN User account passwords. Since AD uses a one way hash for password and you cannot, nor would you want, to retrieve the users actual password, we need to figure out how to best handle passwords in the DNN database versus AD. Some installation may wish to have DNN change the AD passwords to keep them “in-sync“, however in many corporate environments, this is not a valid option.
   
   This leaves us with a couple of options.
1. Tam's WA modifications enter the string “password“ as the password for all accounts. This was done since the DB does not allow nulls for password and you cannot read the AD password. Obviously when using a “mixed-mode“ authentication scheme, this is less than desirable.
2. Upon user account creation, a random password is generated and created for the user in DNN. If the user ever needs to access their portal using forms authentication, they may use the “send passwrod reminder“ option to get the password. They may change this to whatever they wish. Negatvie aspects include this password possibly being different than the users AD password. There is no synch mechanism to AD.
2. How to handle Windows Authentication Failures. What I mean is there are a couple schools of thought so far. If the automatic Windows authentication fails, we allow anonymous access. User then clicks login link and enters username and password. Two thoughts on the next steps are:
1. Attempt to authenticate against AD using the form entered credentials. If access token granted, set the security principal and log user into portal as the ad user. If fail AD forms authentication, then attempt to match against DNN Users table as the normal DNN functionality works.
2. Windows authentication is automatic or does not happen at all. Form credentials are only matched to DNN Users Table.

Still working on the best scenario but I believe we are going to approach this a bit carefully. More to come....