Hello:

I am having issues with Windows Authentication as well, and do NOT want to divert from your specific questions.  It seems to me that using DotNetNuke on an Intranet facing website (... any AD/NTLM environment) in which you would like to use Wiindows authentication for your users who login to a network domain, you need to setup your environment that will allow both "Forms" and "Windows" authentication.  This would make sense since by default, the "admin" and "host" accounts are not domain accounts.  I have tried various combinations and even purchased a module, Active Directory + Groups & Users, from CodeFreak at snowcovered.com but do not have the ideal solution.

If I could quickly outline what you are trying to accomplish and you can make any necessary corrections.  This is at a rather high level:

1. You would like to be able to login with the "Admin" and "Host" accounts, so that you can manage your content and add skins, modules, etc.
2. You would like your users to be able to navigate to your Intranet site and have their NT credentials authenticate them without a login prompt, if possible, i.e. single sign-on.
3. You would like to be able to assign roles to users to manage what content they can and cannot see, and do so using DNN's Roles UI which shows the groups/roles the NT users are assigned.
4. Similar to (3), you would like to use the Page Settings and Module Settings on a Page to assign who can see what.
5. (Nice to Have) You do not want to have to anticipate what roles are valid for a user since different users may belong to more groups than others.  In this case you would like to see any additional roles added programmatically for a user if it does not currently exist.
6. If (5) is not an issue of concern, you would at least like to have domain users associated with the "Registered" role automatically so that they can access pages and modules which have the "Registed" role permissions checked.

I have been searching around on the internet and there many posts and articles which mention how to change this or that attribute, some of which present conflicting information - most likely due to their environment and whether or not they are using DNN or their own ASP.NET website.

If there are any Network Gurus who know how to setup DotNetNuke for Windows authentication, and perhaps, Forms authentication as well this would be very appreciated.  If the steps are different depending on the OS, would it be possible to mention these variations?  The three environments that I am thinking of is Windows XP for development, Windows 2000 Server, and Windows 2003 server.

I am under the gun (like anyone else) in that I am using DotNetNuke 4 for an Intranet website for a large client and cannot move forward until I have this resolved.  Thank you very much for your assistance!

John

The following is how I've setup Authentication for the internet/intranet site running at our school:

1. Followed the directions for the most part in this post: http://www.dotnetnuke.com/Community/ForumsDotNetNuke/tabid/795/forumid/89/threadid/53005/scope/posts/Default.aspx
2. I was getting the same error as Ntk006 but found if I uncommented <identity impersonate="true" /> and added an authenticate userName and password to it so that it ended up looking like <identity impersonate="true" userName="domain\username" password="password" />
3. I then gave that user (doesn't have to be an admin account) the same rights to the DNN directory as the Network Service/ASPNET user.
4. Because the site is also available over the internet we had to re-comment the <authentication..... /> line (that's the most part from #1) otherwise external users would get an IIS logon prompt. Unfortunately this stops users from being automatically logged in.
5. To save users from having to login with DOMAIN\username I used the script from this post (http://www.dotnetnuke.com/Community/ForumsDotNetNuke/tabid/795/forumid/89/threadid/60815/scope/posts/Default.aspx) and made the necessary changes for our domain.
6. Lastly, to make it easier for users to log in while on the intranet I put a link that points to admin/security/windowssignin.aspx and they can just click on that to get logged in (see I Drive or Computer Problems at http://www.bus.nait.ca (yes the site is ugly but that's what you get when people insist on a color combination, it's going to be changed soon) to see what I mean).