asked on

Non-standard User Identification for web application

I am building a mobile web CRM appication that will require users to login to our server. We maintain an extensive user database/definition for these users who are logining in, what database they have access to, their access rights to individual tables, etc., and I need a different approach than the default methodology to track user access.

All communication after login will be via Ajax and Json, and I need to know how I can verify that each request coming from the user is coming from the original mobile device (whether it's an iPhone, iPad, Droid, etc.)

Since I'm pretty new to this, I was wondering what the IIS server, via Asp.MVC has in the way of information that can confirm that the same user that logged in, is the same one now that is making additional requests. Thanks for any infromation, links etc. that can guide me in the right direction!!

bob

ASKER CERTIFIED SOLUTION

gery128

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

marketware

ASKER

OK, so once I have "authenticated" the user, I can then rely on the session ID. Can I also use it in combination with the IP address that is available, or is that overkill? I don't want to have to check too many things on each request or it will slow down my responses. BTW, all interaction with our server will be via SSL.

Also, I want to use my own authentication method (We store username, password and other preferences, etc. in our SQL database), so how do I manually signal to IIS that this user is now "authenticated"? Thanks!!

marketware

ASKER

Thanks. I thought I already rewarded points to this solution, but maybe my submit didn't go through.