Re: Authentication in .NET..... pointers

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Darrin J Olson (darrin.j.olson_at_sio.midco.net)
Date: 02/15/04 

Date: Sat, 14 Feb 2004 19:14:58 -0600

I don't know that I could give you a complete solution, but I can give you
some ideas...

Putting your current authentication methods aside, ASP.NET has the ability
to make Principal objects and Identity objects (FormsIdentity for example)
where you can specify different directory and define application processing
permissions throughout your application and grant certain permissions to
certain users. You can also use the same objects to require a Union and/or
Intersection of permission sets for tasks and/or directories. The Union of
permissions may be helpful in requiring two different permission sets to be
required for access to a directory or to perform a certain task.

The trick would be if you need to tie these users to your current
authentication...

Hope that helps get you in the right direction...

-Darrin

"Paul" <prx1988@hotmail.com.invalid> wrote in message
news:z4rfemq9brLAFw2X@eyeore.home...
> Background.
>
> We have a corporate intranet that is (as much as makes no difference)
> entirely IIS web servers & IE browsers. We use a standard Windows
> domain logon and use active directory. We also have a "standard" user
> (like a guest one) that has few privileges.
>
> Web pages are secured and authenticated by manipulating the permissions
> on the files and folders within the web. This has been the situation
> for a number of years and is relatively set in stone. We use challenge
> response to authenticate for web pages.
>
> If a user logs on as the std user and tries to access a web page to
> which they have no access, a login box appears. If they are really a
> user with the correct credentials they can enter their userid/passwd at
> the prompts. As I understand it, it isn't possible to revoke that
> authentication (ie for that user to log off and revert to the std user)
> without closing down IE and any other browser windows that the user may
> have opened whilst "logged on." Is that correct?
>
> Assuming that is correct, how would we manage the following. Imagine an
> operation that needs two users to authorise it at the time it happens
> (eg a second nurse witnessing the administration of a medicine in a
> hospital, or a superviser check on a large transaction.) How could that
> second person's credentials be checked against their windows domain
> login and subsequently cancelled? Is there really no way to cancel the
> 1st user's logon either?
>
> I'm fairly new to this so would appreciate some pointers.... i've
> pondered with creating session variable "tokens" and all sorts of
> things, but would like a nudge in the right direction before I get too
> embroiled in all this as the inability to revoke the authentication
> always seems to end up scuppering any idea that I have :(
>
>
> Thanks
> --
> Paul

Relevant Pages

  • Re: help me
    ... In addition to deciding what means of authentication you require on your ... anonymous access & either windows integrated authentication, ... based auth scheme, and you reference a fully-qualified domain name, I am ... see the groups currently assigned permissions on this dir. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Windows Security Roles
    ... link the roles to the users in the database by mapping roleid to Active ... his book 'The .Net Developer's Guide to Windows Security' suggests a useful ... the authentication store with the current windows application. ... hold the permissions and the mapping to the AD roles. ...
    (microsoft.public.dotnet.security)
  • RE: default for requiring authentication 2003
    ... Windows 2000 and earlier would allow access as I described and I ... default for requiring authentication 2003 ... resources that have permissions for Everyone unless you enable this setting. ... same username and password as a user on the domain or on the local server. ...
    (Focus-Microsoft)
  • Re: Authentication from Active Directory and Database based user d
    ... with this (I'm not too clear on the permissions to see a page or actual ... You mentioned earlier in the thread that you've used formas authentication ... you don't need separate ... I'm writing a web system ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: pls Help!! After Trust, cannot access from local to foreign do
    ... authentication, they will use the source domain credentials to login. ... Which this is what i want to retain after trust. ... You need to define access by settings permissions on the objects in ... Microsoft MVP - Windows Server - Directory Services ...
    (microsoft.public.windows.server.active_directory)