Re: ASP.NET Authentication

Hello Cathleen C via DotNetMonster.com,

sure use:

<allow role="domain\group" />

never forget the <deny users="*" /> at the end of authZ lists...

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

I considered going with the <authorization/> it just seemed
inefficient to include user names in a file instead of directly on the
folder.

So if I take that approach then I still need to give Network Services
access to the folder in Explorer, and in web.config a list of users
allowed to view the app?  Can I list network groups?  And only those
will be able to view it? Since setting permissions has become more
complicated than just adding users to the directory itself, I fully
expect that you have to list everyone that is denied.

I ran into some info on ACL elsewhere, but all I know is that it
stands for Access Control List.  From where do you access this?

Tahnks for your help.

Joe Kaplan (MVP - ADSI) wrote:

If you are using Windows authentication, it might be easier to just
use the <authorization/> element in the web.config file to specify
allow/deny lists for your application than to resort to file system
ACLs.  ACLs give you defense in depth and are a good idea, but the
<authorization/> element is sufficient for what you want.

If you mess with ACLs, remember that the worker process identity
still needs to be able to read the files too.

Joe K.

I'm now well beyond frustration.

[quoted text clipped - 48 lines]

Can anyone shed some light.  It seems like this should be such a
simple process.



.

Relevant Pages

  • Re: ASP.NET Authentication
    ... include user names in a file instead of directly on the folder. ... Joe Kaplan wrote: ... >for your application than to resort to file system ACLs. ... remember that the worker process identity still needs ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Multiple issues with contact lists in Outlook
    ... If it's a public folder, ... That's the only synchronization in Outlook. ... >>> I had multiple custom contact lists in Outlook 2000. ...
    (microsoft.public.outlook.contacts)
  • Re: Entourage problems with multiple Gmail IMAP accounts?
    ... Now I tried to set up another pop3 account as I have a new email ... Research, Talk Lists, Financial, Orders etc. ... Inbox and Junk folder. ...
    (microsoft.public.mac.office.entourage)
  • Re: computer protection, detection
    ... > Internet History ... > System Temporary Folder ... > Opera Cookies ... > lists all and every autostarting app on your system. ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: [SLE] Destjet printer app has a bug? Signal 11
    ... > maybe I should stick with windows - easier on the blood pressure. ... select the one that looks a little bit like a two toned file folder (at ... where you sign up for Suse's lists. ... You can't "break" your computer by entering commands.. ...
    (SuSE)