Authentication and Authorization CS 3870/CS 5870: Note 11 Authentication and Authorization Membership Provider

Membership Provider Authentication Authorization To identify the user Authorization To give permission to the user Membership Provider ASP.NET approach for Authentication and authorization

Web.Config Machine.config Machine level settings Default settings for all Web applications Application Web.config Under the application main Web site directory Apply to the entire application Overwrite some settings set in Machine.config Local Web.config Each folder under the main Web site can have its own Web.config file Overwrite some settings set in higher level Web.config Not every setting can be set in local Web.config AUTHENTICATION must be set in application Web.config AUTHORIZATION can be different for different folders Page Directives Apply to the page only Overwrite settings set in Web.config

Machine.config on Xray C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config <membership> <providers> <add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" connectionStringName="LocalSqlServer" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="true" applicationName="/" requiresUniqueEmail="false" passwordFormat="Hashed" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="7" minRequiredNonalphanumericCharacters="1" passwordAttemptWindow="10" passwordStrengthRegularExpression=""/> </providers> </membership>

Machine.config on Xray C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config <connectionStrings> <add name="LocalSqlServer" connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf; User Instance=true" providerName="System.Data.SqlClient"/> </connectionStrings>

Web.Config Application Configuration File in the main web site <system.web> <authentication mode="Forms" > <forms name="formsAuth" loginUrl="Prog5/login.aspx" path="/" requireSSL="false" slidingExpiration="true" protection="All" defaultUrl="~/Prog5/Default.aspx" timeout="30" cookieless="UseDeviceProfile" /> </authentication> </system.web>

Authentication To identify the user Four Modes Windows: IntraNet Forms : Internet Passport: MS None

Forms Based Authentication name : cookie's name loginUrl : default is login.aspx path : the location to save the cookie, default is / protection: the amount of protection applied to the cookie Encryption Validation All (both, default) None timeout : minutes (default 30) a durable cookie could be issued

Forms Based Authentication defaultUrl: if the user requests the login.aspx page Otherwise, go to the requested page requiresSSL: credential be sent over an encrypted wire (SSL) slidingExpiration: timeout of the cookie is on a sliding scale cookieless: UseDeviceProfile: default UseCookies: require to use cookies UseUri: force to store credential within Uri AutoDetect: sending a test cookie first

Form Login Create form Login in the main Web site folder Add control Login from tab Login All pages are still accessible to the public

Authorization Application Configuration File in the main folder </system.web> <authentication mode="Forms"> </authentication> <authorization> <deny users="?" /> </authorization>

Authorization Application Configuration File in the main folder </system.web> <authentication mode="Forms"> </authentication> <location path=“Prog5"> <system.web> <authorization> <deny users="?" /> </authorization> </location> <!–- could have multiple locations -->

Control CreateUserWizard Add a form CreateUser.aspx under the main folder Add control CreateUserWizard Toolbox/Login Create one user UserName: csse Password: cs3870@UWP Your email Your choices for others

Event ContinueButtonClick In CreateUser.aspx.vb Select CreateUserWizard1 Select event ContinueButtonClick Code Response.Redirect(“Prog5/Login.aspx")

Authorization <deny users="*" /> <allow users="*" /> <allow users="[comma separated list of users]" roles="[comma separated list of roles]" verbs="[comma separated list of roles]"/> <deny users="[comma separated list of users]" * : everyone ? : anonymous verbs: POST, GET, HEADER, DEBUG

Other Login Controls Toolbox/Login ChangePassword LoginName LoginStatus LoginView PasswordRecovery

Prog5MasterPage Add LoginName and LoginStatus

Correct All Mistakes of Prog4 If you make the same mistakes in Prog5 as you did in Prog4, the number of points you lose will be doubled!