User Authentication with urlmon?

[Mordox]

Hi guys,

This will be a fairly easy problem to solve for someone who is more familiar with VB6 than I am, or so I'm thinking.

I've made an app that downloads a bunch of files from my company website, it uses urlmon to do this. The app works fine when run from a company computer on the intranet, but when I run the app from a remote machine off the intranet, none of the files are downloaded. This is obviously because of user access permissions. I have no idea how to do a user authentication here. Is there something in urlmon to do this for me? or do I do the user authentication by modifying the url to contain username and password info?

Thanks in advance,
Mordox.

[Mordox]

Well after more surfing I've discovered that the IAuthenticate interface needs to be implemented to provide an event function that will respond to the user authentication challenge. Unfortunately all the examples I've seen of actually using this interface are very vague, the MSDN description (http://msdn.microsoft.com/library/de...thenticate.asp) only gives a bare bones account of what it does and has an example written in C which uses pointers =/ .

For some reason my VB environment cant even find this interface, yet I have seen a couple of confusing examples which use it in VB.

[Al42]

Are you sure there's a path from the requesting computer to the server you're requesting the file from? Routers block incoming requests by default.

[Mordox]

Are you sure there's a path from the requesting computer to the server you're requesting the file from? Routers block incoming requests by default.

Yeah, all the files I'm trying to download can be downloaded via a browser from a remote machine, however the domain requires the user to log in. My app just fails to download any files at all and doesnt give the user a prompt for their login details. It seems that I'm not the only one looking for other examples of using the IAuthentication interface, the one on MSDN doesnt even seem to work the way it says it should =/

[Al42]

What's doing the download? A web server? If so, your app can connect with a login and password. Just have textboxes for the user to enter them, and check that they're not blank before attempting to connect. The syntax is

"http://" & txtLogin.Text & ":" & txtPassword.Text & "@" & strURL & ":" & strPort

Of course you can leave the ":" & port off if it's 80.

[Mordox]

So you're saying that

DownloadFile "http://" & txtLogin.Text & ":" & txtPassword.Text & "@" & strURL & ":" & strPort&"\SubFolder\abc.dat", "C:\\TargetDir\abc.dat"

should login under the username entered and download the file. I have read from a few different places that in the next patch of Internet Explorer that URL's containing '@' are no longer going to be accepted (http://builder.com.com/5100-6373-5152488.html). Will this affect my app?

I've also heard that sending username and passwords in this method sends them with no encryption, and they can be recorded relatively easily. The IAuthenticate interface looks like a nice way of doing user authentication but there is very little information on it. Perhaps I will have network admin make a username and passwork just for my app and restrict it to the areas I need, that way I can simply hardcode it in so that the user never sees this process and I dont have to worry about the security issues too much. Still, its not really the best solution

[Al42]

So you're saying that

DownloadFile "http://" & txtLogin.Text & ":" & txtPassword.Text & "@" & strURL & ":" & strPort&"\SubFolder\abc.dat", "C:\\TargetDir\abc.dat"

should login under the username entered and download the file.

IF you're logging into a web page.

I have read from a few different places that in the next patch of Internet Explorer that URL's containing '@' are no longer going to be accepted (http://builder.com.com/5100-6373-5152488.html). Will this affect my app?

If you use the next version of IE to do it, it won't work. If you use VB to do it, it will. The change to IE doesn't change the version of VB you already have on your computer.

I've also heard that sending username and passwords in this method sends them with no encryption, and they can be recorded relatively easily.

Define "easily".

It's true that they're being sent unencrypted, but I wouldn't call capturing packets from the internet "easy".

The IAuthenticate interface looks like a nice way of doing user authentication but there is very little information on it. Perhaps I will have network admin make a username and passwork just for my app and restrict it to the areas I need, that way I can simply hardcode it in so that the user never sees this process and I dont have to worry about the security issues too much. Still, its not really the best solution

You might want to look at this control. Look at WBAuthenticate, the 8th item in the list.

[Mordox]

You might want to look at this control. Look at WBAuthenticate, the 8th item in the list.

This is an excellent example, exactly what I was looking for. I'm going to sift through this and pick out exactly how the OnAuthentication event works so that I can make a nice lightweight dll I can use for all future projects for user authentication.

Define "easily".

It's true that they're being sent unencrypted, but I wouldn't call capturing packets from the internet "easy".

I know its not 'easy' as such to intercept packets passing through a router unless you can make a very nice peice of spyware, but I have to explain my app to my manager on several different points, one of which is security. Passing usernames and passwords in the same unencrypted query would not be acceptable to them in most situations as we do work for clients which require certain levels of security clearances.

Thanks for your help Al42 =P You've helped me clear up a few things I wasnt sure about.