Created by : Asst. Prof. Ashish Shah ASP.NET SECURITY

THREE INTERLIKED CONCEPT OF SECURITY W.R.T. ASP.NET Created by : Asst. Prof. Ashish Shah THREE INTERLIKED CONCEPT OF SECURITY W.R.T. ASP.NET VIZ. AUTHENTICATION, AUTHORIZATION,IMPERSONATE. AUTHENTICATION: IT IS A PROCES OF SOME SORT OF IDENTIFICATION ARE OBTAINED FROM THE USERS AND USING IDENTIFICATION TO VERIFY OF HIM. THE DIFF. MODES OF IT ARE ACCEPTED THROUGH SETTINGS THAT CAN BE APPLIED TO THE APPLICATIONS WEB.CONFIG FILE, WHICH IS XML-BASED & ALLOW CHANGING OF ASP.NET BEHAVIOR EASILY.

THREE DIFF. PROVIDERS OF AUTHENTICATION Created by : Asst. Prof. Ashish Shah THREE DIFF. PROVIDERS OF AUTHENTICATION GENERAL SYNTAX OF IT IS: <system.web> <authentication mode=“Windows|Forms|Passport”> </authentication> </system.web> WINDOWS: IT ALLOWS TO AUNTICATE USER BASED ON THEIR WINDOWS ACCOUNTS. THIS PROVIDER USES IIS TO PERFORM THE AUTHENTICATION AND THEN PASSES THE AUTHENTICATED IDENTITY TO YOUR CODE. IT IS A DEFAULT PROVIDED BY ASP.NET. Syntex for it is as follows. <authentication mode=“Windows” > </authentication> <authorization> <allow users=“*” /> </authorization> note : if the user has supplied valied credentials access is only granted.

Windows authentication Created by : Asst. Prof. Ashish Shah Windows authentication Four diff. Kinds of this options are as follows. Anonymous: in this, IIS does not perform any authentication check & allows any user to access the application. Basic: in this, windows user name and password have to be provided to connect. Digest: this is same as basic but the password is hashed before it is sent across the network. Integrated windows: in this password is not sent across the network and some protocols are used to authenticate users. It provides tools for strong cryptography which is used to secure information through out the network.

Created by : Asst. Prof. Ashish Shah Forms Authentication It provides a way to handle authentication using custom logic with application. It uses the cookie concept for authentication. Configuration of web.xml for this type is : <system.web> <authentication mode=“Forms” > <forms loginUrl-”login.aspx” name=“loginform” /> </authentication> <authorization> <deny users=“?” /> </authorization> </system.web> Note: for the anonymous user, acess is denied in the authorization section of above code. All users must enter their credentials using login form.

Passport Authentication Created by : Asst. Prof. Ashish Shah Passport Authentication It allows microsoft passport service to authenticate users for application. If users have signed up with passport and if authentication mode of application also passport then all authentication duties are offloaded to the passport servers. It uses an encrypted cookie mechanism to indicate authenticate users. If users have already signed into passport when they visit site then they will be considered as a authenticated users. Otherwise it will be redirected to the passport server to login. When they are successfully login then only they will be redirected to your web site. Web.cofing is configured as follows: <system.web> <authentication mode=“Passport”> <passport RedirectionUrl=“login.aspx” /> </authentication> </system.web>

Created by : Asst. Prof. Ashish Shah Authorization Authentication & Authorization are two interconnected security concepts. First is process of identifying a user and authorization is the process of checking whether authenticated user has access to the resource which they requested. Two form of Authorization: File: it is performed by the File Authorization Module . It uses the access control list (ACL) of the .aspx file to resolve whether a user should have access to the file. ACL permissions are confirmed for the users windows identity. 2) URL: in the web.config file you can specify the authorization rules for various directories of files using the <authorization> element. Systex is : <system.web> <authorization> <allow users=“abc” /> <deny users=“*” /> </authorization>

Created by : Asst. Prof. Ashish Shah Impersonation It is the process of executing code in the frame work of another user entity. By default all asp.net code is executed using a fixed machin-specific account. To execute code using another identity you can use the built-in impresonation capabilities of asp.net. This technique allows the asp.net process to act as the authenticated user or as an arbitrary specified user. It is controlled by <identity> tag in the applications web.config file. The default setting of impersonation as false, as shown <identity impersonate=“false” />

Created by : Asst. Prof. Ashish Shah Impersonation Now asp.net does not performs imporsnation. It means that asp.net will runs with its own previlliges. The second possible setting is to turn on impersonation as <identity impersonate=“true” /> To impersonate a specific user for all the requests on all the pages of asp.net application, you can specify username and password attributes in the <identity> tag of the web.config file for that application as follows. <identity impersonate=“true” username=“domain\username” password=“password” />