RE: Windows authentication with custom user store

You can write an HttpModule that handles AuthorizeRequest (or in global.asax for a start)

in this event you can check your userstore and see if the user is in the allowed list.

This event gets called on every request - once you have this working, you can think about optimizations, like a cookie or a flag in the cache...


-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

Another option could be the use of a custom "authentication cookie"
that is issued after the user is located in the user store. This
cookie should then be checked in every request. What would be a good
technique for this solution?



.

Relevant Pages

  • RE: HTTPModule - an interceptor indeed, but without communication skills!
    ... httpModule to check in the certain event before request has been processed ... easily manually append such querystring to bypass the validation. ... My suggestion is what about the cookie? ... In the validation code, you can use javascript ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Printing website - cookies
    ... would be requested with the Print command so that the latest version of any ... gets that cookie). ... At the request of any "private" article or image, ... All "private" images in the article turn out, on paper, as the default ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Problem with Forms Authentication cookies
    ... > only 2, the ASP.NET_SessionID cookie and the Forms Authentication cookie, ... > The next request coming is is a GET request for the Forms Authentication ... > In looking at the logs for NORMAL expired authentication redirects these ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: User.IsInRole not redirecting
    ... Dim hash As String = FormsAuthentication.Encrypt ... Dim cookie As New HttpCookie ... Sub Application_AuthenticateRequest(ByVal sender As Object, ... Each request that comes in (via the ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Request Cookies right after theyre being Set
    ... > the response object is updated. ... BUT NOT the request object. ... ' Creates a new cookie "test" with value DateTime.Now ...
    (microsoft.public.dotnet.framework.aspnet)