Member Avatar for dharam_hbtik

Hi everybody,

My request out here is Urgent, though i have passed through what I could access in this forum and others also, but cannot finding a working solution.

I have designed an ASP.NET application, at our organizational intranet, I have used Windows Authentication and it worked very efficiently. My problem is, I want my application to ask for re-entering of employee's credential when he clicked on a log out control ( it could be anything - i didn't decided what will trigger log out yet ). I want it to be like Sharepoint page where you can log as another user in the same machine.

I m using following code but not working properly.

protected void Page_Load(object sender, EventArgs e)
    {
        if (!this.IsPostBack)
        {
            _User = User.Identity.Name.Replace("Domain\\", "");
            Label1.Text = _User;
        }
    }
    protected void LinkButton1_Click(object sender, EventArgs e)
    {
       
            Response.StatusCode = 401;
            Response.StatusDescription = "Unauthorized";
            Response.End();
            Response.Redirect("Default.aspx");       
    }

and my HTML or aspx CODE IS

<head runat="server">
    <title>Untitled Page</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
        <p>Hello <asp:Label ID="Label1" runat="server" Text="Label"></asp:Label></p>
        <asp:LinkButton ID="LinkButton1" runat="server" onclick="LinkButton1_Click">Sign in as Different user</asp:LinkButton>
    </div>
    </form>
</body>
</html>

I am waiting ...

Thanks.

Edited by dharam_hbtik because: Code formatting
  • 1 Contributor
  • 2 Replies
  • 359 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by dharam_hbtik

Dani AI

Generated

— short answer: what you're fighting is the browser + Windows-auth protocol, not ASP.NET. Browsers automatically send the logged‑in Windows credentials for intranet sites (NTLM/Kerberos). A server-side 401 or client script can't reliably "clear" that cache across all browsers and OSes, so you'll see repeated prompts (NTLM does a multi-step handshake) and then the connection fails.

Two practical, reliable approaches:

  • Switch to a login page (Forms auth) that validates the supplied username/password against Active Directory. That lets you implement a real Logout (clear the auth cookie) and a clean "Sign in as different user" workflow. Example validation (use System.DirectoryServices.AccountManagement):
using System.DirectoryServices.AccountManagement;

bool ValidateAD(string domain, string user, string pass)
{
    using (var pc = new PrincipalContext(ContextType.Domain, domain))
    {
        return pc.ValidateCredentials(user, pass);
    }
}

// on success: create forms ticket or call FormsAuthentication.SetAuthCookie(user, false)

Also set <authentication mode="Forms"> with a loginUrl in web.config and use FormsAuthentication.SignOut() for logout.

  • If you must keep Integrated Windows Authentication, use Basic authentication over HTTPS so the browser shows a username/password prompt. Important: Basic sends credentials encoded (not encrypted) so TLS is mandatory. Even then, some browsers will cache credentials until the browser process ends.

Quick tips and alternatives:

  • For testing or one-off sign-ins, start the browser using "Run as different user" (Shift+RightClick → Run as different user or the runas command) so the browser process uses another Windows account.
  • document.execCommand("ClearAuthenticationCache") works only in specific IE scenarios; it is not cross‑browser and not reliable.
  • If you need to access network resources as the authenticated user, be aware that Forms auth alone does not give you a Windows token — impersonation requires a Win32 LogonUser flow and careful secure handling.

Recommendation: use Forms auth + AD validation for full control and a predictable "sign in as different user" experience.

Member Avatar for dharam_hbtik

I Have also tried

document.execCommand("ClearAuthenticationCache")

but it only works on IE and on the server machine only , on clients machine it won't work

Edited by dharam_hbtik because: formatting
Member Avatar for dharam_hbtik

I Have also tried

document.execCommand("ClearAuthenticationCache")

but it only works on IE and on the server machine only , on clients machine it won't work

somewhere i found this modified code

protected void Page_Load(object sender, EventArgs e)
    {
        if (!this.IsPostBack)
        {
                this.hiddenCurrentUser.Value = Request.LogonUserIdentity.Name;
	_User = User.Identity.Name.Replace("Domain\\", "");
                Label1.Text = _User;
        }
    }
    protected void LinkButton1_Click(object sender, EventArgs e)
    {
       
             if (this.hiddenCurrentUser.Value != Request.LogonUserIdentity.Name)
             {
		 Response.Redirect("Default.aspx");       
              }
else
{
            Response.StatusCode = 401;
            Response.StatusDescription = "Unauthorized";
            Response.End();
}
           
    }

and HTMl Code is

<head runat="server">
    <title>Untitled Page</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
        <p>Hello <asp:Label ID="Label1" runat="server" Text="Label"></asp:Label></p>
        <asp:LinkButton ID="LinkButton1" runat="server" onclick="LinkButton1_Click">Sign in as Different user</asp:LinkButton>
    </div>
<input type="hidden" id="hiddenCurrentUser" name="hiddenCurrentUser" runat="server" value="0" visible="false" />
    </form>
</body>
</html>

now the problem is

what happen if i enter the same credential again?

i am using the above given code and when i am entering different credentials then its working fine.

but when i am using same credentials then it again ask for credentials for 2 more times.

and after clicking 3 times the page get washout.

and when i click on back button and again refresh the page then it accepts the credentials...

plz suggest me some way to overcome this problem..

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.