Re: AuthorizationStoreRoleProvider Issues

Dominick,

Thank you for your article as it was informative. Unfortunately I can
authenticate fine but no one is now able to enter the application. When I
enter my username and password it just takes me back to the login.aspx page
no matter who I am.

I have my roles configured through azMan and they are mapping to the
correct groups. I did make sure that all users are a member of the group I
added in azMan.

I have no Defenition or Role assignments in azMan. Is that something I
need to allow myself in? How should I proceed?

-Timothy


"Dominick Baier [DevelopMentor]" <dbaier@xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
wrote in message news:4580be6319a7fa8c838ef561abac8@xxxxxxxxxxxxxxxxxxxxx
change the authorization section to:

allow roles="Users"
deny users="*"

http://www.leastprivilege.com/ASPNETAuthorizationSettings.aspx

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

I have been working on some sample applications to proof new security
enhancements as far as roles based and authorization based security. I
am using a trest active directory, forms based authentication with the
form control, and the AzMan.msc tool to create my roles and policy XML
file I am accessing. SO far everything is going great...

Now my issue is this, maybe someone can shed some light on this. My
AuthUsers.xml file is laid out like so:

<?xml version="1.0" encoding="utf-8" ?>
- <AzAdminManager MajorVersion="1" MinorVersion="0"
Description="Authorization Store for the AuthUser Application">
- <AzApplicationGroup Guid="7037a5f2-178d-4056-8dad-342f9d5c6c95"
Name="Administrator" Description="Datacenter Organizer Administrators"
GroupType="Basic">
<Member>S-1-5-21-3137277063-3307450293-2828318362-1111</Member>
</AzApplicationGroup>
- <AzApplicationGroup Guid="e8109261-2b4a-4c67-ab22-400f72b9db2a"
Name="SecurityAdmin" Description="Datacenter Organizer Security
Administrators" GroupType="Basic">
<Member>S-1-5-21-3137277063-3307450293-2828318362-1110</Member>
</AzApplicationGroup>
- <AzApplicationGroup Guid="a5de19aa-bbfb-4b2e-8bd0-635fcd7c7193"
Name="Auditors" Description="Datacenter Organizer Auditors"
GroupType="Basic">
<Member>S-1-5-21-3137277063-3307450293-2828318362-1108</Member>
</AzApplicationGroup>
- <AzApplication Guid="16e7da53-4973-40b5-a2d0-2e2e95afcccb"
Name="AuthUser"
Description="" ApplicationVersion="">
- <AzApplicationGroup Guid="8cd3d253-c302-4875-912e-5a179ba9ad93"
Name="Users" Description="" GroupType="Basic">
<Member>S-1-5-21-3137277063-3307450293-2828318362-1112</Member>
</AzApplicationGroup>
</AzApplication>
</AzAdminManager>
Now as you cane see I have create dan Application called: AuthUser and
assigned a Group called 'Users'. The Users group is linked to the
Active Directory Group 'DCO_User'. So far everything works like a
charm.

I have 2 users:
1. Tim
2. TestMan
Tim belongs to the DCO_User group, while TestMan does not belong to
any groups. Now I have set my authorization section in my web.config
file to be:

<authorization>
<deny users="?"/>
<!-- Deny anonymous access to website -->
<allow roles="Users"/>
<!-- Allow all users -->
</authorization>
As you cane see, the only ROLE allowed is USERS which links to the
DCO_User AD group. Whenever I authenticate, both users are let and and
see the default.aspx page. While this si nice now that there are no
errors, I didnt want TestMan to get in at all!

So me delima is thatr TestMan is not supposed to be able to access
this application. Any suggestions?





.

Relevant Pages

  • Re: GenericPrincipal
    ... them up again, then you need to persist them in cache, session or in a ... forms or windows authtentication. ... Then use that for authorization throughout the application ... to have to authorize and authenticate some one on each request. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Problem with IIS and Group Premissions.
    ... "not authenticate" is a 401.1 error and "not authorized" ... > Authorization means that the Windows account you are using has appropriate ... > restricted area of the website. ...
    (microsoft.public.inetserver.iis)
  • Help With Security Please
    ... and I am wondering how I shoudl handle security. ... first inclination is to use the Web.config and use Authorization to ... here connect to Active Directory and authenticate the users that way, ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Client/server application and Windows Integrated Auth
    ... Why not let the datastore authenticate the user and do the authorization ... There is only a client application than ...
    (microsoft.public.platformsdk.security)
  • Re: Client/server application and Windows Integrated Auth
    ... Why not let the datastore authenticate the user and do the authorization ... There is only a client application than ...
    (microsoft.public.dotnet.framework.aspnet.security)