Introduction to .net Impersonation Vijay Kumar Musham CS 795 Old Dominion University Guide Dr Ravi mukkamala

Agenda Introduction Security flow for a request (asp.net) Brief notes on Authentication and Authorization Impersonation Demo References

Security Flow for a Request (ASP.NET)

Authentication ASP.NET authentication providers Forms Authentication Forms, Windows, Passport, Default, and Custom Forms Authentication <authentication mode="Forms"> <forms name=".ASPXAUTH" loginUrl="login.aspx" protection="All" timeout="30" path="/" /> </authentication>

Forms Authentication Flow

Contd.. Windows Authentication Can be used in combination with Basic, NTLM, Digest, Kerberos, and so forth User is authenticated by IIS Easiest of all Request flow Client makes request IIS authenticates request, forwards to ASP.NET Impersonation turned on? ASP.NET returns response to client <authentication mode=" Windows" /> <authorization> <deny users="?" /> <allow users= "*" /> </authorization>

Impersonation An important security feature is the ability to control the identity under which code is executed. Impersonation is when ASP.NET executes code in the context of an authenticated and authorized client. By default, ASP.NET does not use impersonation and instead executes all code using the same user account as the ASP.NET process, which is typically the ASPNET account

Contd.. if a web page has no access controls, then any user can access that web page. HTML pages, ASP pages, and components in version 3.0 and earlier can be accessed through two accounts named IUSR_machinename and IWAM_machinename When IIS receives a request for a web page or other resource that has permission for anonymous access, IIS treats the IUSR_machinename account as the user's account, to access the resources. If the resource requested by the user is an ASP page that uses a COM or COM+ component, that component is executed using the IWAM_machinename account.

Contd.. In ASP.NET, when impersonation is turned off, the resources can be accessed using a "local system process" account. When impersonation is turned on, ASP.NET executes every resource using the account of a specified user who is authenticated when the user makes the request. If you specify the IUSR_machinename account to be used as the user account, then ASP.NET will behave like previous versions of ASP, in providing access to the resources.

Contd.. In ASP.NET, you first need to check whether the application is configured to use impersonation. In the case of IIS, the IIS impersonates users with its own IUSR account. In the case of ASP.NET, impersonation is used to decide whether the user's request should be executed using the account of the requested user, or that of a local system-process account that ASP.NET uses for anonymous requests.

Summary If impersonation is enabled in an ASP.NET application then: • If anonymous access is enabled in IIS, the request is made using the IUSR_machinename account. • If anonymous access is disabled in IIS, the request is made using the account of the authenticated user. • In either case, permissions for the account are checked in the Windows Access Control List (ACL) for the resource(s) that a user requests, and a resource is only available if the account they are running under is valid for that resource.

Contd.. If impersonation is disabled in an ASP.NET application then: • If anonymous access is enabled in IIS, the request is made using the system-level process account. • If anonymous access is disabled in IIS, the request is made using the account of the authenticated user. • In either case, permissions for the account are checked in the Windows ACL for the resource(s) that a user requests, and a resource is only available if the account they are running under is valid for that resource.

DEMO

Result 1 IIS tagged the request with vinay’s access token, and it passed that access token to ASP.NET. ASP.NET knows that the caller is vinay and won’t allow vinay to retrieve an ASPX file (or any other ASP.NET file type) for which vinay lacks access permission. But because Web.config lacks a statement enabling impersonation, any code executed inside the request executes as ASPNET, not as vinay. ASPNET has permission to read Bonuses.xml, so vinay wasn’t prevented from viewing employee bonuses.

Result 2 After making the change to Web.config, restart your browser, log in as Vinay, and try to view Bonuses.aspx again. This time, you’re greeted with an error message reporting that an error occurred while processing the page. That message is displayed by the exception handler in Bonuses.aspx’s Page_Load method, which catches the XmlException thrown when ReadXml can’t read Bonuses.xml. Restart your browser and log in as Vijay, however, and you can once again view Bonuses.aspx.

References Msdn - impersonation http://msdn.microsoft.com/en-us/library/aa292118(VS.71).aspx Programming Microsoft .net – jeff proise http://www.dotnet-guide.com/impersonation.html Moving a Web Application to Classic Mode http://msdn.microsoft.com/en-us/library/bb515251.aspx