Web.config: <allow users="xxxx" /> Where does xxxx come from?

From: sjl (noemail_at_email.com)
Date: 04/26/05

  • Next message: J'son: "Re: Creating User Accounts with or without Active Directory" 
    Date: Mon, 25 Apr 2005 22:56:50 -0500

    I'm using Forms Authentication. When I authenticate a user from a database,
    I use the following line:
    FormsAuthentication.RedirectFromLoginPage(parameterID.Value.ToString(),chkRemember.Checked);

    where parameterID.Value is the ouput parameter from my stored proc which is
    the primary key from the database of the user who logged in. That way, I
    always use that key when writing back to the database for various tasks
    (Page.User.Identity.Name). Is that the same value that gets evaluated in
    the web.config file authorization section to allow/deny users? For example,
    what user am I really looking for if I use <allow users="xxxx" /> in the
    web.config file? They login using email/password, but I write the
    authentication ticket using the primary key from the database.

    What I'm really wanting to do is use forms auth to secure one folder for
    only authenticated users. Anyone who is registered on my site and logs in
    can get to all files in that folder. Additionally, I'd like to have an
    administrative back-end for the site in another subfolder that will only all
    myself into. Am I forced to use roles to accomplish this or can I do this
    with simple web.config settings?

    Thanks in advance.
    sjl

  • Next message: J'son: "Re: Creating User Accounts with or without Active Directory"

    Relevant Pages

    • ASP.NET Forms Authentication Best Practices
      ... ASP.NET Forms Authentication Best Practices ... What happens if your user database is compromised? ... Listing One, where you want to use login.aspx to log users in. ... string FirstName ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Security question ..
      ... What I want to prevent is any access to the database accept through our ... application unless you have elevated permissions. ... Authentication, if he is smart enough to create an NT Auth ODBC connection ... passes through to the database or to use SQL Server authentication. ...
      (microsoft.public.sqlserver.server)
    • User authentication over the web (was: Secure Password in database)
      ... Subject: User authentication over the web (was: Secure Password in database) ... a web server is usually authenticated to users by using SSL or TLS ...
      (SecProg)
    • Re: Using SSPI with Custom Authentication
      ... It boils down to moving the security perimeter away from the server. ... first database contains all of the user information; ... perform authentication, and users need to be authenticated before accessing ...
      (microsoft.public.dotnet.security)
    • Re: SQL Express MDF file moved from 1 computer to another - auth f
      ... I try to attach the database which is located in MyDocuments\Visual ... Microsoft SQL Server Management Studio ... now it tells me that authentication has failed for my windows ...
      (microsoft.public.sqlserver.connect)