Implementing Authorization and authentication in ASP.netSecurity is an important aspect while designing internet applications. It provides the robustness and reliability by checking the access to the system resources and thus restricts the usage to only limited group who has been authorized. Authentication process involves validation of the user‘s identity by getting the user credentials and validate the identity with values stored internally.
Authorization
determines the level of access to the system resources to the authenticated
user based on the profile of the User, which would have already been configured.
For example, usually an Administrator level of User will have authorization
configured so that he has access rights to access all the system resources.
Authorization will always follow Authentication and both are essential
for a secured application. Authentication
in ASP.Net ASP.net offers
three types of Authentication which are as below: • Windows
authentication Authentication
type can be set in the web.config file in the section as below: Windows authentication
is basically managed by IIS. There are four types of Windows authentication
which are anonymous, basic, digest and Windows Integrated. All these options
are configured in IIS. By selecting
anonymous option, there will be not be any authentication performed by
the IIS and hence anyone can be allowed to access the application. Using
basic authentication, windows user name and password are used to authenticate
for which the information is sent over the network which makes it insecure.
If digest authentication is selected, password is encoded before sent
across the network. This option
necessitates client machines to be using Internet Explorer (IE) 5.0 or
above and windows account to be stored in Active directory. Windows Integrated
option uses Kerberos (Challenge/response) protocol to authenticate the
user. This method provides secret-key cryptography technique and hence
ensures the information transmitted is highly secure. For this, client
browser needs to be IE 3.0 or above. Passport
authentication method uses the Passport Authentication service provided
by Microsoft for authenticating users. By using this method, applications
can be relieved of the authentication routine that needs to be implemented
in the main application. Passport identifies an authenticated user by
checking for the encrypted cookie in the client system. In case of failure
at this level, they will be redirected to passport servers for authentication.
To implement this, the Passport Development SDK (Software Development
Kit) is required. Forms authentication
is a type of custom authentication where the User can design his own customized
logic for logging into the system. This method is based on cookie which
gets placed by the first successful request by the client. This will be
used to track the User about his state of access to the server. For every
request made by the client for a web page, ASP.net checks for the existence
of this special cookie in the client system. If it exists, it implies
that client is authenticated. Otherwise, it does not process the request
and redirects the User to an error page. Authorization
in ASP.net ASP.net is
a process within IIS and executes in the security context of a restricted
User account which has limited access to both local and shared resources.
To enable it to have additional rights, impersonation is used. Impersonation
provides the facility to execute the request from the client using its
identity or use a specific account as configured in web.config file. To
disable impersonation, set the file as below: Authorization
without impersonation Without impersonation,
ASP.net will execute with its own privileges. Usually, this account (ASPNET)
in which the ASP.net runtime executes would be a low-privileged account
since this is the default account and is applicable to all the sites in
the server. Enabling it to a high-privileged account is a high risk since
ASP.net process run by any client can access system resources and can
cause harm to them. Machine.config is the file where the privilege of
ASPNET account can be configured. Authorization
with impersonation There are
two options with impersonation enabled. Using identity
of the client logging to the system If Anonymous
access is allowed in IIS, ASP.net uses its own configured account which
the IIS itself uses. Using
identity of a pre-defined user By setting
the web.config file with details of the User name and password of the
User whose credentials need to be used for executing the application,
ASP.net process can execute in the identity of that User. The main drawback
of this method is the security risk that anyone can access the file containing
the password in text form. Design considerations
for implementing Authentication and Authorization in Distributed applications • IIS
is the first level of access for any request coming from a client. In
case there is a need to reject request from some pre-defined IP addresses,
options can be set in IIS for achieving it.
_______________________________________________________________________
FREE
Subscription
Subscribe
to our mailing list and receive new articles Note
: We never rent, trade, or sell my email lists to Visit
.NET Programming Tutorial Homepage ______________________________________________________ |
