RE: Mixed authentication schemes

From: Bassel Tabbara (basseltonline@microsoft.com)
Date: 11/14/02


From: basseltonline@microsoft.com (Bassel Tabbara (MS))
Date: Thu, 14 Nov 2002 19:43:13 GMT


Hi,

Question:
A set of pages in the web application are configured to use forms
authentication, while other pages are used for
administrative purposes. What type of configuration is needed to allow both
authentication?

Answer:
Windows and Forms authentication can be running in parallel if they are
separated
by application boundary. One web application can be configured to use
Windows authentication
and the other can use Forms Authentication. The configuration of this web
application directory can be nested
or in parallel.

For example, Web Application A uses Forms Authentication and Web
application B uses Windows Authentication.
Application A can be below application B. In this case, App B contains the
web.config with Windows Authentication
which overrides the configuration in App A. The other scenario is the usual
one where App A and App B are on the same level.

I am note sure if the admin pages are used to administer other pages in
your application. I would appreciate if you can clarify
more that point.

Thanks,
Bassel Tabbara (MS)

This posting is provided “AS IS” with no warranties, and confers no rights.
You assume all risk for your use.
© 2001 Microsoft Corporation. All rights reserved.
--------------------
| Content-Class: urn:content-classes:message
| From: "Wes Weeks" <anon@nospam.com>
| Sender: "Wes Weeks" <anon@nospam.com>
| Subject: Mixed authentication schemes
| Date: Thu, 14 Nov 2002 07:02:57 -0800
| Lines: 11
| Message-ID: <110e101c28bee$eaab5710$2ae2c90a@phx.gbl>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="iso-8859-1"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
| Thread-Index: AcKL7uqrBuqBoXHhShaiZZM55W9xUA==
| Newsgroups: microsoft.public.dotnet.framework.aspnet.security
| NNTP-Posting-Host: TKMSFTNGXA14 10.201.226.42
| Path: cpmsftngxa06!cpmsftngxa09!cpmsftngxa08
| Xref: cpmsftngxa06 microsoft.public.dotnet.framework.aspnet.security:3005
| X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet.security
|
| Is it possbile to use both Forms and Windows
| authentication schemes within the same web site? I have
| some pages that are public but require regsitration for
| viewing, while I also have some admin type pages that need
| read/write access to the website directories and files
| which need to be Windows authenticated in order to grant
| these writes. Any ideas?
|
| Thanks,
|
| Wes Weeks
|



Relevant Pages

  • Solaris Security Summary
    ... Administering Security on the Solaris OE ... Configuration control, facility management, and system ... Authentication: The ability to prove who you are. ...
    (comp.unix.solaris)
  • RE: Using both Forms and Windows Security...
    ... This can be done by using the location configuration section which can ... Page1.aspx and page2.aspx are accessed by the internet user after being ... form authentication. ... This page is configured just for windows authentication. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: SQLServer login with Trusted Connection thru ASP
    ... Jim Corey wrote: ... > We're looking at logging on to SQLServer using Windows Authentication ... > from an ASP app, and trying to figure out what will work. ...
    (microsoft.public.inetserver.asp.general)
  • Re: I dont want to re-invent the Login/Login Wheel - Help with utilities
    ... In the case of AS.NET app, being hosted by ISP, it is very likely the users are not windows domain user. ... the membership provider uses SQL Server or SQL Server Express. ... Both Windows authentication and authorization wolud be be fine if we wanted the world to have access to our application data, but not very intuitive for maintaining integrity over our data. ...
    (microsoft.public.vstudio.general)
  • Re: POP3 Security & SMTP Authentication
    ... configuration of Exchange 2003 will require a userid/password to collect ... setup a second SMTP virtual server that only accepts Basic Authentication ... > 2) all clients send/receive external email using outlook via an external ...
    (microsoft.public.exchange2000.general)