Re: Webapp Authentication best practice...

"Joe" <Joe@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:68398643-BBB0-451F-90F8-434E426642F7@xxxxxxxxxxxxxxxx
Willy,

These are clients that are accessing the Web app via the INTERNET.

Ok, so you can't use Windows authentication.

So, currently they login and I capture their login information after I
authenticate their credentials.

Using basic authentication? In that case, you have a serious security issue, it's your job to authenticate incoming users in the strongest possible fashion (possibly using certificates), failing to do so leaves yourself wide open to attack!

The functions that they are performing are Group membership maintenance.
for a specific OU.

So, I doubt that it is good practice to capture and retain their credentials
in memory and then create a new DirectoryEntry each time that I want
to perform a function (like enumerate groups, modify membership etc...).

Once the clients are authenticated you don't need to keep their credentials around, all you should do is switch identities when accessing AD resources, that is, you should access the AD from asp.net using "explicit" credentials, or (better) delegate the AD function to a COM+ server application (using System.EnterpriseServices) that runs in an account with specific/restricted AD access privileges and possibly using role based security for finer grained access control.
The latter scenario is better because it offers both stronger security and better scalability.

Willy.

.

Relevant Pages

  • Re: Large-scale 1-1 NAT
    ... gateway and send them the security team. ... between clients and public IPs, why do you need the NAT at all. ... this to save public IPs by NOT giving them to unauthenticated users? ... only allocate the device a public AP after authentication has occured. ...
    (freebsd-net)
  • Security Concerns...
    ... Have used Site Server for security purposes in the past. ... I find strange that the the actual credential authentication is ... creation doesn't happen unless the credentials have been verified first ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Default credentials
    ... > comes up on my client site requires NTLM or Basic authentication? ... > a web browser - I assume it must be something they have set up ... If your receive a Dialog asking for your creds with NTLM auth ... credentials of the current security context. ...
    (microsoft.public.dotnet.framework.aspnet.webservices)
  • Re: Default credentials
    ... > comes up on my client site requires NTLM or Basic authentication? ... > a web browser - I assume it must be something they have set up ... If your receive a Dialog asking for your creds with NTLM auth ... credentials of the current security context. ...
    (microsoft.public.dotnet.framework.webservices)
  • Re: Default credentials
    ... > comes up on my client site requires NTLM or Basic authentication? ... > a web browser - I assume it must be something they have set up ... If your receive a Dialog asking for your creds with NTLM auth ... credentials of the current security context. ...
    (microsoft.public.dotnet.security)