Re: Windows Authentication (asp.net 1.1 C#)

Hi,

it is up to you how you store your passwords - FormsAuth is just a mechanism to "remember" authenticated users (and reject anonymous).

Usually you store the passwords in a database using salted hashes - have a look at PasswordDeriveBytes class (or Rfc2898DeriveBytes on 2.0)

In ASP.NET 2.0 you may want to have a look at the membership provider.

Also this could be a good start:
http://samples.gotdotnet.com/quickstart/aspplus/doc/formsauth.aspx

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

can you point me to FormAuthentication with encrypted passwords Thanks

"Dominick Baier [DevelopMentor]" wrote:

Hi,

i wouldn't recommend using your internal AD for customer accounts.
FormsAuthentication is as secure as IIS integrated auth - and you
need SSL for both anyway.

There is no easy way to get a forms based login for IIS integrated
auth - this would require to craft the authentication headers on the
client - maybe be easy for basic auth - but beyond.

I would go for FormsAuth + SSL

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

I'm creating a site which will allow our clients to place orders.
Because of
different price list and sensitive merchandise we sell (Medical
Supplies.)
I'm concerned about security. I though that either I have to do a
Windows
Authentication or Form Authentication. If I use windows
authentication, I can
validate with my domain and I wouldn't have a problem with that,
unless that
would cause a problem with my internal security. The Second option
is
Form
Authenticated.
My Question is
1) If I use Windows Authentication can I bypass the browser dialog
box
and
use  a form with textboxes to do the sign in. I seen that Microsoft
Exchange
Web Outlook 2003 can do this.  Is this possible? Someone told me at
the asp
group that it was not, but since it was asp and not asp.net, I want
it
to
ask.
2) Can I run into internal security problems if I give them a
restricted
windows account? I guess the answer is yes... (Did I just answer my
self?)
3) Can you point me at another method of secure login, like forms
but
with
encryptation, that can allow me to not have to validate with my
domain.
Thank you
Francisco O.
IBLUES



.

Relevant Pages

  • Re: inetOrgperson /userPasswords
    ... You can already use "pass-through" authentication with ADAM today. ... > We store passwords in our own bespoke attribute not ...
    (microsoft.public.windows.server.active_directory)
  • Re: Need to upgrade password security
    ... system in place using mod_auth_mysql and Basic authentication. ... should be able to set their own passwords and change them. ... I've never written any PHP or Javascript, but I'm experienced with CGI. ... relying on basic HTTP authentication ...
    (comp.infosystems.www.servers.unix)
  • Re: ADAM - SSO and provisioning considerations
    ... install an OU, do LDAP bind's to AD for authentication, and used some ... The above illustrates why you don't need ADAM. ... store for your identity store. ... they are all in the customer's identity store. ...
    (microsoft.public.windows.server.active_directory)
  • SSH Close to working, but need help!
    ... connecting to host with "public authentication failed for user xxx" ... Protocol 2,1 ... # To disable tunneled clear text passwords, ... # Kerberos TGT Passing only works with the AFS kaserver ...
    (comp.security.ssh)
  • problem on sshd setup: public key support
    ... Now I have some problem to setup public key authentication: ... Server refused our key ... # To disable tunneled clear text passwords, ... # Kerberos TGT Passing only works with the AFS ...
    (comp.os.linux.misc)