Previous Next

Thread: IIS Windows Integrated Auth - is it possible to deny multiple logins?

Last post 08-11-2008 7:51 AM by VaeVictis. 2 replies.

Average Rating Rate It (5)

RSS

Page 1 of 1 (3 items)

Sort Posts:

  • 07-31-2008, 9:59 AM

    IIS Windows Integrated Auth - is it possible to deny multiple logins?

    Hi all :)

    Following up from my previous thread http://forums.iis.net/p/1150483/1874269.aspx#1874269 which is now thankfully resolved, another problem arises :/

     
    Is there a way of allowing only 1 instance of someone using the credentials to access a directory?

    Example:

    Say I create a virtual directory - called "test" now, I allow the user Bill to access that directory so Bill goes to www.mywebsite.com/test and is asked for the Integrated Windows Username and Password. He types in his login details, and is allowed access to the directory, and continues on happily.

    But then his friend mike calls him up, and asks for his username and password  which Bill gives to him, Mike is on a completely different IP address, but types in Bills username and Password and once again is allowed access, so now the 2 are happily browsing through the directory test, using just the 1 Username and password.

    Is there a way of stopping this ? Ideally I only would like 1 session to be allowed at the same time, and in an ideal solution the IP address / event would be logged because 2 people at the same time tried to access the protected directory using the username and password.

    At the moment the IIS logfiles (W3C logs) do show me the users accessing the directory - however it is a bit of a pain, both in terms of how fidely it is and the amount of time it takes to check the logs to be sure.

    The reason is we are offering clients online training, and obviously don't want them or our suppliers to be giving out their details allowing 10 of their friends on at once (slight exaggeration there).

    The server is a Windows 2003 box, with IIS 6.0 running - albeit under IIS 5.0 Isolation mode (which is a requirement the training software itself has).

    If anyone can give a solution to either the multi users at the same time with the same username and password or a good way of making the log files more readable it would be greatly appreciated! :) 

  • 07-31-2008, 2:03 PM In reply to

    • tomkmvp
    • Top 10 Contributor
    • Joined on 03-20-2003, 10:27 AM
    • Lawrenceville, NJ
    • Posts 4,070
    • IIS MVPs

    Re: IIS Windows Integrated Auth - is it possible to deny multiple logins?

    There is nothing native or built-in to IIS to do this.

    As far as log files go, have you seen logparser?  That would allow you to query by username and IP ...

    http://forums.iis.net/default.aspx?GroupID=51
    http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07

  • 08-11-2008, 7:51 AM In reply to

    Re: IIS Windows Integrated Auth - is it possible to deny multiple logins?

    Thanks once again Tom for the reply, as always very helpful.

    I would just like to issue an apology for taking so long to respond, I completely forgot that my company was breaking up for a week when I made this thread, so obviously couldn't respond.

    I will check out your suggestions, thanks again :)
     

Page 1 of 1 (3 items)
Page view counter