Best approach for database/windows authentication integration?

From: Steve (stephenmcnabb_at_yahoo.co.uk)
Date: 01/15/04 

Date: 15 Jan 2004 04:07:26 -0800

We have an ASP.NET application that consists of about 10 forms and we
want to be able to control which user has access to which pages. So
User A should be able to access pages 3, 4 and 10, and User B should
be able to access pages 1, 2 and 9 etc. We also want to be able to
mantain these rules using a set of maintenance tables e.g. add pages,
groups, users and setup which groups have access to which pages.

At the moment we are going down the path of creating a set of classes
to integrate the security in to the front-end, with each page having a
call at the top of the page that passes in the page name and the
user's login name and the object will return either True or False as
to whether they can access the page or not.

The application is currently setup with Anonymous Access off and Basic
Authentication & Integrated Windows Authentication turned on, so that
we can get the users login name for database auditing purposes.

However, I've read bits and pieces on the builtin form authentication
in ASP.NET and I would like to take advantage of it if it will handle
the scenario I have described.

We don't require a user to login, aside from the standard IE
authentication login, and we want to display a custom message if they
don't have access to the particular page they are trying to access.
The most important thing is that the security must be driven by our
maintainable database tables.

Is there a feature of ASP.NET that allows us to handle this with
minimal custom code? Or maybe there's a better ASP.NET way of handling
this?

Thanks for any assistance you can give me.

Steve

Relevant Pages

  • [Full-Disclosure] Advisory: Dark Age of Camelot - Weak encryption of network traffic exposed persona
    ... Weak encryption in game client exposed customer billing and authentication ... encryption for billing information. ... The login binary has undergone several updates since then. ...
    (Full-Disclosure)
  • Re: [PHP] Is this the best way?
    ... Why is Jason schreefing again? ... maybe I should edit my authentication function... ... attempting to login. ... really be either attempting an authentication *or* outputting some ...
    (php.general)
  • Authentication Sharing Across Apps
    ... For my part "B" question that I had (Login App was not returning ... authentication to calling app), I found the solution. ... Basically, in both the Login App and Calling App Web.Config, I did ... authenticated connection with SQL server. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: [PHP] Is this the best way?
    ... Jason Pruim schreef: ... I am attempting to add a little error checking for a very simple login system. ... So maybe I should edit my authentication function... ... really be either attempting an authentication *or* outputting some message ...
    (php.general)
  • Unable to get IP Address from DHCP server - 802.1x authentication
    ... user based VLAN authentication with Windows client as ... Authentication method: MD5-Challenge ... Login locally with the cached profile of user1 ... After entering the Radius server username & password the ...
    (microsoft.public.win2000.security)