Re: Securing a .NET webapp with ActiveDir and SQL-server?

That's what I would do. Hope it helps.

> > - why do you need authorization inside your app? are only specific emps
> > allowed to see specific customers?
>
> Yes.

Use Forms authentication + SSL in the asp.net app. User.isInRole could
help.

> Ok. But should I have my webapp supply the sproc with the name/identity of
> the user as an argument, and have the sproc make an access-check, and create
> a logrecord in my logtable and THEN pass data back to the webapp, or should
> my webapp call a series of sprocs ?

If you impersonate the web app, use integrated security (windows login)
and grant exec on the sproc to the desired roles that shouldn't be
necesary. Maybe this is not too clear..

> Can I have sql-server (sproc) encrypt/decrypt the data instead of the webapp
> (.net) ?

The webapp IMHO. I don't remember how can the SQL server - Web App can
be encrypted using SSL, but it is a good thing.

> > switching to 2.0 is recommended.
>
> In general or for this specific purpose ?

Both things. 2.0 security is better than 1.x (1.x is NOT insecure) and
2.0 has great ASP.NET things.

.

Relevant Pages

  • Re: Registry access permission doesnt obey impersonated user
    ... I tested accessing the registry from an asp.net app and everything works ... > -I load the webapp, click the button, and the content is shown, as expected. ... > sourceControl, String eventArgument) +18 ... have any effect whether I denied read or not, the app read the key fine. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Securing a .NET webapp with ActiveDir and SQL-server?
    ... the user as an argument, and have the sproc make an access-check, and create ... a logrecord in my logtable and THEN pass data back to the webapp, ... > - use SSL - for IIS and SQL Server ... When the user clicks the "See Customer Details" button I ...
    (microsoft.public.dotnet.security)
  • Re: counts the number of hit on a website containing many JSPs
    ... And go explain your customer that your webapp apears at the ... like the web couldn't see the app just because it controls its ... Nothing I suggest prevents opening tabs in the web app. ... and a POST request is not more difficult ...
    (comp.lang.java.programmer)
  • Re: counts the number of hit on a website containing many JSPs
    ... opening up certain URLs in the app to direct access. ... So, all the internal navigation is done with POSTs, but links from the outside to the webapp is done via GET. ... And all the links below the form look like internal hyperlinks to me. ... and a POST request is not more difficult ...
    (comp.lang.java.programmer)
  • Handling errors raised from a SQL Server stored procedure
    ... I call a SQL Server stored procedure using ADO 2.5 in an Access 2000 app. ... This stored proc does many things and I've got much error handling code in ... sproc is run by my app, it stops execution at the first error. ...
    (microsoft.public.data.ado)
Loading