I'm writing an intranet application. ASP.NET 2.0, VB. Most of the app, I need to know who the user is, but anyone can use it. There's one area for admins only, and eventually I'll have a couple of other sections for various types of specialist super-user. I think I've caught on to the basic idea of how this should work, but I'm running into trouble in spots, and wonder if I'm misunderstanding something basic.
Windows authentication, and I've got it detecting the authenticated user and matching them against "their" records in my database.
Web.config includes <identity impersonate="true" ></identity> and I've checked that Environment.UserName looks right. I've caught on to the idea that Environment.UserName and User.Identity.Name are two different things unless I have Impersonation switched on.
Now I want to protect that admin area. So I get my colleagues to set me up an Active Directory group, ...
Go to the complete details ...