This article describes authentication mechanisms that you can use along with Image Uploader. Both versions of the control support them, but they do that differently. Here is what you can use to authenticate users:
- Basic authentication
- Integrated Windows authentication (NTLM)
- Custom cookie-based authentication
- URL-based authentication
In addition, both versions of the control support HTTPS connections.
The main difference between the two versions from the authentication point of view is that the Java version of Image Uploader is not integrated with the browser enough. Although it can get cookies and additional data through HTML, it opens sockets "manually" and sends files independently from the browser; hence, it cannot use most of the browser security settings. So it cannot use the same authentication at the current page. It means that if the site requires a password and the user is already logged in, Image Uploader will still display an authentication dialog where the user should enter their name and password.
Contrary, the ActiveX version uses Internet Explorer HTTP communication to upload files. It has no custom implementation of the upload mechanism. The transfer is performed in the same way as it is done by Internet Explorer. As a result, Image Uploader uses the same HTTP settings as the web page which hosts the control.
Basic Authentication
If your site is secured using basic authentication and the user is already logged in, the ActiveX version will allow uploading files without asking a user name and a password. The Java version will pop up a login dialog, prompting the user to provide their credentials. In this case you may want to customize this dialog using the AuthenticationRequestBasicText property. This authentication scheme does not require any server-side scripting support, but you will need to set up your web server properly. For instructions, refer to your server documentation.
Remember that the password will be sent over the network as plain text.
Integrated Windows Authentication (NTLM)
When using this method, both versions of Image Uploader will behave as in the previous case. Again, the login dialog that the Java version will open can be customized using the AuthenticationRequestNtlmText property. This authentication scheme doesn't require any server-side scripting support, too. For instructions on configuring your web server, refer to its documentation.
Custom Cookie-Based Authentication
This scheme requires additional support in server-side scripts. What exactly you will have to do, depends on your web server, scripting language, and frameworks you use. But in general you will need to:
- Provide some storage for user credentials.
- Create a login form to check user names and passwords and set cookies.
- Add checks, whether the user is identified, to your server scripts.
Both versions of Image Uploader will extract browser cookies automatically and send them along with images. But keep in mind that you should not use HTTP-only cookies that cannot be obtained through JavaScript and consequently through LiveConnect, as the Java version uses the LiveConnect interface to access browser cookies.
URL-Based Authentication
In general, this mechanism is similar to the previous one, but in this case all the information required for user identification is passed through the URL, not via cookies. In other words, you could specify a special URL in the Action property, like upload.aspx?id=ldmvqinmsodjuhfqajmduj, to send the user identity. Then the upload.aspx script on the server will analyze the id request variable and implement the authentication logic appropriately.
See Also
Reference
AuthenticationRequestBasicText Property
AuthenticationRequestNtlmText Property
AuthenticationRequestButtonOkText Property
AuthenticationRequestButtonCancelText Property
AuthenticationRequestLoginText Property
AuthenticationRequestDomainText Property
AuthenticationRequestPasswordText Property
Action Property