1

I am using SharePiont Server 2007 Enterprise with Windows Server 2008 Enterprise. I am developing using VSTS 2008 + C# + .Net 3.5. I am wondering whether SharePoint has any means to set an anonymous user to be some specific user by code automatically?

For example, I want to set the anonymous to be administrator automatically when the anonymous connects from a specific IP address to access default.aspx (i.e. no need to let the user know password of administrator if the user connects from a special machine with a special IP address). Another example is when anonymous user connects my site using special connection string, like http://mysite/default.aspx?specialtestuser=foo,then I will set current anonymous to be foo.Appreciate if any code samples to reference?

BTW: I am using Forms authentication, not sure whether in Forms authentication in SharePoint, there are any ways to set the anonymous user to someone based on some custom defined rules(e.g. IP address or http parameter)?

Improve this question

4 Answers 4

Reset to default
1

This method: FormsAuthentication.SetAuthCookie() has worked for me in the past when I was trying to create an NTLM login into FBA.

Improve this answer
3
  • 1. If I call FormsAuthentication.SetAuthCookie("foo", false), then in the continuous interactions between the end user browser, the end user will be treated as "foo"? 2. Another confusion is, if I am using an XML file to store user name and password for my custom Forms Authentication, but no user called "foo", what will be happened if I call FormsAuthentication.SetAuthCookie("foo", false)?
    – George2
    Commented Nov 26, 2009 at 17:54
  • 1. yes 2. I don't know, i'm assuming they will just continue being anonymous.
    – Steve Lineberry
    Commented Nov 26, 2009 at 21:35
  • Also, you should know that the auth cookie gets sent to the client together with the reponse. Between your call to SetAuthCookie() and the end of the response the client will not be authenticated. The client will have to make another request to the server which posts the cookie to the server which is required for the server to recognise the client as an authorised user.
    – Jaap Vossers
    Commented Nov 27, 2009 at 0:41
1

The above question sounds a bit scary to me. You do realize that IP's can be spoofed? It sounds like a very insecure way to handle administrative privileges. If i was in your IT department, i would be worried :-)

Improve this answer
1
  • 1
    I agree, but he did say in the question that the scenerio was "For Example". Anything like this should go under extensive testing and security audits.
    – Steve Lineberry
    Commented Nov 26, 2009 at 21:37
1

Jumping on Anders wagon here. Doing that will create a security risk on your SharePoint environment and I would advise against it.

Improve this answer
1

Even though it's dangerous, it can be quite powerful if you now what you are doing.

I have done something similar before, where people could switch the identity of the current user to another one simply by clicking on a username in a list of available users. Obviously this is something you would only use for dev and testing purposes and NOT FOR PRODUCTION.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.