IIS6, SQL authentication and logging, can it be done?

From: Wes (wes_at_checkind.com)
Date: 05/23/03

  • Next message: Peter: "Content advisor" 
    Date: Fri, 23 May 2003 10:21:17 +0100

    Hi,

    I need to build an extranet and ideally would like to authenticate the users
    from a database table, authorize them from a text file of usernames in each
    protected directory and have all HTTP server access logged, with
    authenticated username, back into the same database.

    I've so far spent a couple of days looking into various options and so far
    found nothing that does exactly what I need.

    Passport authentication is no use to me as I would prefer to keep control of
    the users myself.

    Forms authentication allows me to authenticate against my database, and in
    theory write out appropriate web.config files to each directory for
    authorization. I have two problems with Forms though - as I understand it
    IIS needs to have anonymous access enabled and the users are then
    authenticated for the ASP.NET application. This means the username doesn't
    get logged by IIS as there is no user as far as it's concerned. After
    further reading to find a way round this I discovered that Forms
    authorization only works against .aspx files by default, that I need to
    register other file extensions to be protected and that there is fairly
    large overhead involved with this, and that finally the user needs to have
    Office 2000 SR1a or above installed to avoid getting a login box appear in
    the Office application for a protected file.

    Windows authentication and folder ACL authorization is the other option. The
    users would be authenticated against IIS so all HTTP access would be logged
    with a username and the ACL will protect the files. The only problem is, I
    don't really want to create lots of Windows accounts. Even though logins
    will be SSL protected and the extranet group of users be prevented from
    logging in, it just worries me! Plus there is the disadvantage of having to
    manage the windows users and a database for the rest of the system, where I
    would prefer just to manage a database for everything.

    This can be easily be achieved using Apache and MySQL, but I need to use
    IIS6 and SQL Server 2000.

    It seems Forms does half what I need, and Windows the other half. I really
    feel I must be missing something here; it's so simple to do with Apache, why
    not with IIS?

    I don't really want to write a custom IIS Logging module (if that would even
    help?!) and I have found and currently looking at Authentix (www.flicks.com)
    and IISProtect (www.iisprotect.com) but don't see why I can't do what I need
    using IIS alone.

    Installing Apache on the Windows 2003 server isn't an option (and from a
    brief look around I'm not sure Apache will authenticate or log to SQL Server
    with or without ODBC, though I did only look at this quickly).

    Any help appreciated!

    Thanks,

    Wes

  • Next message: Peter: "Content advisor"

    Relevant Pages

    • IIS6, SQL authentication and logging, can it be done?
      ... authenticated username, back into the same database. ... with a username and the ACL will protect the files. ... and I have found and currently looking at Authentix ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: database password and encryption
      ... I know the basic concepts about encryption. ... This database should be encrypted with a strong, ... way you can protect the database AT ALL. ... I could encrypt the key several times and hide the new, resulting, keys on ...
      (microsoft.public.platformsdk.security)
    • Re: password-copyright
      ... it's basically the same exact mechanism as a login ... verify one item, such as a keyword, phrase, or password. ... database and if it is, you set a cookie saying they are authenticated. ... trying to protect your work or some similar profession, ...
      (microsoft.public.frontpage.client)
    • Re: MDF file level security from copying
      ... is a way to protect the MDF files, ... located on FAT like Windows 98 and Windows ME, ... >BTW, if you are concerned about the database schema, as ... >> file while the sql server is stopped? ...
      (microsoft.public.sqlserver.security)
    • Re: Help! Back button - Redesign Project???
      ... > A unique index can protect you from users inserting duplicate records ... > in subsequent posts. ... > The best way to protect the database is to build protection into the ...
      (microsoft.public.dotnet.framework.aspnet)