GEEK I want to create a Visual Basic-based component that will accept a user's login credentials, check their validity, then check whether that user is a member of a given domain group. I don't want to track user security in a database, but instead rely on the existing security model of Windows NT. All authorized users of my application will be members of a particular group in the domain. How can I do this with the Win32? API?
GEEK When you say "accept a user's login credentials," do you mean that you want your application to display a dialog box in which the user enters their user name and password, which your application in turn passes on to the system? If so, this is a dangerous thing, since you would essentially be impersonating the security of the system. This is not something that can be provided without consequences.
The user should have already been required to authenticate themselves to the system if they're working directly from a networked workstation that is part of the specified domain. If the user is accessing your system via the Web, then again, this can be accomplished within the confines of the OS by simply assigning the appropriate privileges to the files that the user might be trying to access. The system will then issue a challenge/response, which will force a login request.
Your application's simple attempt to open a file to which only the appropriate users would have read access would be a quick way to test for authentication.
If you're attempting a Web-based login, essentially the same process could be used. Access privileges would be set not against a file, but against the Web pages that users are trying to access. This would tie the security directly to the Web access via the Windows NT-based user database.
