Similar issue with .NET Security

From: Ed Hastings via .NET 247 (anonymous_at_dotnet247.com)
Date: 04/28/04 

Date: Tue, 27 Apr 2004 17:42:50 -0700

Hello; having similar ASP.NET security issues.

Upgrading a number of ASP classic apps to .NET and have everything done but cant figure out how to get the security to work correctly.

Under the ASP Classic implementations security was NT Groups based. Various Groups were created for different access rights, and the apps just checked the logged in user against ADSI to determine if they were in the correct group(s) for whatever access.

This was accomplished quite easily by dim-ing out an object for the Domain and flipping thru the Groups to find the one of interests and then checking to see if the user logged on to the app was in that group, and setting a session variable to that effect.

This had many advantages, including the fact that Networks administered the user accounts, adding & removing people from groups, and so on without Development needing to get involved. It was also easy, and allowed users to log into the system from any machine they happened to be at as themselves.

Under ASP.NET however, Windows authentication picks up the person logged in on the computer itself defeating part of the desired functionality.

So I tried Forms based authentication and though various books list ADSI as being a valid source of comparison for login verification I cant find one line of code on how to do that; all the examples use a custom independently managed Database, XML files, or hardcoding the user info directly in the web config (!), the last to of which strike me as generally bad ideas. I dont have any problem doing the Database option if necessary, but as all of the user security is already set up and better yet administered by Networks I would much rather find a way to use the existing infrastructure to manage this.

Any ideas how to force .NET to accept a forms based authentication and then verify it against ADSI?

Thanx!

--------------------------------
From: Ed Hastings

-----------------------
Posted by a user from .NET 247 (http://www.dotnet247.com/)

<Id>NU9di4RXnUy12Bd0qmE80w==</Id>

Relevant Pages

  • RE: Login Failure to Frontpage Admin
    ... compromise security to my websites and my server as the follwing procedure ... did popup a security message. ... My websites by default were ALL set to "Integrated Windows Authentication" ...
    (microsoft.public.frontpage.extensions.windowsnt)
  • security works for VPN users, doesnt for local
    ... i am attempting to configure security for an intranet web application ... it uses Windows authentication, retrieving roles from ... "Directory Security" tab in IIS i have: ... unchecked "Enable anonymous access" ...
    (microsoft.public.dotnet.framework.aspnet)
  • IIS6.0 use anonymous and integrated security a the same time
    ... I set up a IIS 6.0 sever a while ago when we were young and innocent and decided to implement a few simple security baseline for the intranet web site: ... The problem is we don't share an active directory or any NT domain relationship at all, so I need to activate the anonymous access on the web site and if I do that, I cannot use the windows authentication anymore... ... continue using the IIS/NTFS authentication for my domain users OR still get the security information with the anonymous acces activated. ...
    (microsoft.public.inetserver.iis.security)
  • Re: security works for VPN users, doesnt for local
    ... What machine is the VPN machine? ... The web server by chance? ... it uses Windows authentication, retrieving roles from ... "Directory Security" tab in IIS i have: ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Brute Force
    ... Security reasons: ... Windows Authentication has certain benefits over SQL Server Authentication, ...
    (microsoft.public.sqlserver.security)