ASP.NET security advice wanted

From: Bill Zack (wzack_at_compuserve.com)
Date: 11/02/03

  • Next message: Kris van der Mast: "Re: Forms authentication in a subfolder problem, please help" 
    Date: 1 Nov 2003 16:56:26 -0800

    We have an interesting ASP.NET security design problem. I think that
    I have worked out a solution, but I want to make sure that I am not
    off base. I would appreciate any advice that anyone might be willing
    to give me.

    For a new application we have both Intranet and Extranet users. For
    Extranet user we cannot use inter-domain trusts (the normal Extranet
    design pattern) for political reasons.

    We are using Windows 2000/Active Directory. The application will be
    written in ASP.NET. SSL will be used for all requests. The server(s)
    will have certificates, but the clients will not.

    1. Extranet users
    First time Extranet users must go through an ASP.NET registration
    application. In this application IIS security is set to only allow
    request from certain IP addresses and Domains (Own and clients) IIS
    Authenticates them as an Anonymous users. ASP.NET Authenticates with
    Forms Authentication, redirecting them to a Logon page. The Logon
    page uses Impersonation with the identity of a specific user that can
    add new users to the AD domain. They are then added to the domain as
    a member of a special Extranet group with minimal/no privileges.

    Note: I realize that this will allow anyone to add themselves as
    users. Later, an administrator will use another ASP.NET application
    (using Windows Integrated Authentication) to increase their
    privileges, put them in specific groups that have specific roles, etc.
     We may also need to clean up "ghost" users periodically.

    Then, after registration, they can be authenticated using Windows
    Integrated Security as described below.

    2. Intranet users
    Intranet users (and registered Extranet users) will be authenticated
    by IIS using Windows Integrated security and ASP.NET Windows security.
     Since Intranet users are already authenticated by Windows they will
    not be required to present their credentials when entering the
    application. Extranet users will be forced to present their
    credentials when entering our domain since their passwords in their
    home and our local domain will most likely be different. (This is the
    part that I am not sure of.) Once they do they will be authenticated
    as domain users in our domain.

    Impersonation/Delegation will then be used to access a middle tier
    application that accesses an Oracle database. The Oracle database
    will use their passed credentials to limit them to seeing only their
    own data.

    Are there any holes in my logic for handling Extranet users?

    Thanks
    Bill Zack

  • Next message: Kris van der Mast: "Re: Forms authentication in a subfolder problem, please help"

    Relevant Pages

    • Re: IIS / NTFS Security Issues with hyperlink within e-mail
      ... Security" dialog is also displayed requesting the user ... > the "AUTH_USER" server variable. ... > Security" dialog is also displayed requesting the user ... > authenticates to access the page, ...
      (microsoft.public.inetserver.iis.security)
    • Mutual Authentication scheme
      ... I am developing a web solution for the company that I work for and would ... like to have as much security as possible. ... SSL only authenticates the ...
      (Security-Basics)
    • Re: Can I do client side populations from my ASP Page?
      ... and I am hoping that our reliance on vbscript will provide an extra ... layer of security when extranet users find that our pages do not work! ...
      (microsoft.public.scripting.vbscript)
    • Session Authentication
      ... Lets say i have a login system. ... This system authenticates the user via ... mysql, when the user is authenticated, i set a session variable to let the ... what can i do to prevent this or increase security? ...
      (php.general)