Re: Allow certain users for an intranet app

Better create a windows group and use

<allow roles="Group" />

don't forget the

<deny users="*" />

at the end ;)


-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

My web app reads/writes to the db and the company will only authorize
some users to access and run the app. It will be used as an intranet
behind Company's firewall. Should I add the users in the web.config
file as in the following:

<authentication mode="Windows"/>
<identity impersonate="true"/>
<authorization>
<allow users="b.smith, m.thomas" />
This will allow "b.smith" and "m.thomas" access to the app.

Thanks,
maa


.

Relevant Pages

  • Re: Protecting .NET assemblies (runtime)
    ... Dominick Baier ... Developing More Secure Microsoft ASP.NET 2.0 Applications ... mentions nothing about how to use it to protect assemblies. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Protecting .NET assemblies (runtime)
    ... Dominick Baier ... Developing More Secure Microsoft ASP.NET 2.0 Applications ... mentions nothing about how to use it to protect assemblies. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Win 2003 svr/ASP.NET 2.0 UNC share
    ... Dominick Baier ... Developing More Secure Microsoft ASP.NET 2.0 Applications ... Now I need to setup Kerberos between the web1 and fileserver web2. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Protecting .NET assemblies (runtime)
    ... Dominick Baier ... Developing More Secure Microsoft ASP.NET 2.0 Applications ... mentions nothing about how to use it to protect assemblies. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Protecting .NET assemblies (runtime)
    ... Dominick Baier ... Developing More Secure Microsoft ASP.NET 2.0 Applications ... mentions nothing about how to use it to protect assemblies. ...
    (microsoft.public.dotnet.framework.aspnet.security)