IIS7: Using Basic Authentication may cause premature user lockouts.

////////////////////////////////////////////////////////////////////////////
// BEGIN CODE
using System;
using System.ComponentModel;
using System.Runtime.InteropServices;
using System.Text;
using System.Web;

namespace SampleCode
{
    public class BasicLockoutWorkaround : IHttpModule
    {
       #region Members
        private bool _disposed;
        #endregion

        #region Imports
        [DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        private static extern bool LogonUser(
            string Username,
            string Domain,
            string Password,
            LOGON32_LOGON LogonType,
            LOGON32_PROVIDER LogonProvider,
            ref IntPtr Token
            );

        [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
        private static extern bool CloseHandle(
            IntPtr handle
            );
        #endregion

        #region Enumerations
        public enum LOGON32_PROVIDER : uint
        {
            DEFAULT = 0,
            WINNT35 = 1,
            WINNT40 = 2,
            WINNT50 = 3
        }
        public enum LOGON32_LOGON : uint
        {
            /// <summary>This logon type is intended for users who will be interactively using the computer, such as a user being
            /// logged on by a terminal server, remote shell, or similar process. This logon type has the additional expense of
            /// caching logon information for disconnected operations; therefore, it is inappropriate for some client/server applications,
            /// such as a mail server.</summary>
            INTERACTIVE = 2,
            /// <summary>This logon type is intended for high performance servers to authenticate plaintext passwords. The LogonUser
            /// function does not cache credentials for this logon type.</summary>
            NETWORK = 3,
            /// <summary>This logon type is intended for batch servers, where processes may be executing on behalf of a user
            /// without their direct intervention. This type is also for higher performance servers that process many plaintext
            /// authentication attempts at a time, such as mail or Web servers. The LogonUser function does not cache credentials
            /// for this logon type.</summary>
            BATCH = 4,
            /// <summary>Indicates a service-type logon. The account provided must have the service privilege enabled.</summary>
            SERVICE = 5,
            /// <summary>This logon type is for GINA DLLs that log on users who will be interactively using the computer. This logon
            /// type can generate a unique audit record that shows when the workstation was unlocked.</summary>
            UNLOCK = 7,
            /// <summary>This logon type preserves the name and password in the authentication package, which allows the server to make
            /// connections to other network servers while impersonating the client. A server can accept plaintext credentials from a client,
            /// call LogonUser, verify that the user can access the system across the network, and still communicate with other servers.</summary>
            NETWORK_CLEARTEXT = 8,
            /// <summary>This logon type allows the caller to clone its current token and specify new credentials for outbound connections.
            /// The new logon session has the same local identifier but uses different credentials for other network connections. This logon type
            /// is supported only by the LOGON32_PROVIDER_WINNT50 logon provider.</summary>
            NEW_CREDENTIALS = 9
        }
        #endregion

        #region Methods
       public void Init(HttpApplication application)
        {
            application.BeginRequest += new EventHandler(this.OnBeginRequest);
        }
        private void OnBeginRequest(object sender, EventArgs e)
        {
            HttpContext context = HttpContext.Current;

            if (context != null)
            {
                string authorization = context.Request.ServerVariables["HTTP_AUTHORIZATION"];
                if (authorization != null)
                {
                    if (authorization.StartsWith("Basic ", StringComparison.OrdinalIgnoreCase))
                    {
                        int index = authorization.IndexOf(" ");
                        if (index != -1)
                        {
                            try
                            {
                                authorization = authorization.Substring(index + 1);

                                UTF8Encoding encoder = new UTF8Encoding();
                                Decoder decoder = encoder.GetDecoder();

                                byte[] bytes = Convert.FromBase64String(authorization);
                                int count = decoder.GetCharCount(bytes, 0, bytes.Length);
                                char[] characters = new char[count];
                                decoder.GetChars(bytes, 0, bytes.Length, characters, 0);
                                authorization = new string(characters);
                                index = authorization.IndexOf(":");
                                if (index != -1)
                                {
                                    IntPtr token = IntPtr.Zero;
                                    string domainName = null;
                                    string userName = authorization.Substring(0, index);
                                    string password = authorization.Substring(index + 1);

                                    index = userName.IndexOf("\\");
                                    if (index != -1)
                                    {
                                        domainName = userName.Substring(0, index);
                                        userName = userName.Substring(index + 1);
                                    }
                                    bool success = false;

                                    try
                                    {
                                        success = LogonUser(
                                            userName,
                                            domainName,
                                            password,
                                            LOGON32_LOGON.NETWORK_CLEARTEXT,
                                            LOGON32_PROVIDER.DEFAULT,
                                            ref token
                                            );
                                    }
                                    finally
                                    {
                                        if (!success)
                                        {
                                            Win32Exception exception = new Win32Exception();
                                            context.Response.AppendToLog("401Reason=0x" + exception.NativeErrorCode.ToString("X"));

                                            context.Response.Clear();
                                            context.Response.StatusCode = 401;
                                            context.Response.SubStatusCode = 1;
                                            context.Response.StatusDescription = exception.Message;
                                            context.Response.End();
                                        }

                                        if (token != IntPtr.Zero)
                                            CloseHandle(token);
                                    }
                                }
                            }
                            catch (Exception ex)
                            {
                                context.Trace.Write("OnBeginRequest", "Error decoding Authorization header: " + ex.Message);
                            }
                        }
                    }
                }
            }
        }
        public void Dispose()
        {
            if (!this._disposed)
            {
                lock (this)
                {
                    if (!this._disposed)
                    {
                        this._disposed = true;

                        HttpContext context = HttpContext.Current;

                        if (context != null)
                        {
                            HttpApplication application = context.ApplicationInstance;
                            application.BeginRequest -= new EventHandler(this.OnBeginRequest);
                        }
                    }
                }
            }
        }
        #endregion
    }
}
// END CODE
////////////////////////////////////////////////////////////////////////////