1. Chapter 13 – Site Security

2. Internet Information Server ASP.NET Applications.NET Framework Windows NT/2000 Operating System Forms Passport Windows Certificates Anonymous Standard Windows Digest Code Access Security Active Directory File Permissions Web Clients SSL

3. Web Clients Get Default.aspx Security Authority Windows Forms Passport Custom user id=GlennJ password=hi2u2! Who are you? Provide proof. Ok, here is Default.aspx Authentication

4. Web Clients GlennJ says: Select * from Orders Is GlennJ Authorized to retrieve the Orders? Here are the Orders. Authorization

5. Workgroup Client Workgroup Client Workgroup Client Workgroup Client Directory Users Administrator Randy Gary Sue Directory Groups Users Managers Directory Users Administrator Randy Gary Sue Directory Groups Users Managers Directory Users Administrator Randy Gary Sue Directory Groups Users Managers Directory Users Administrator Randy Gary Sue Directory Groups Users Managers

6. Local User Account Creation

7. Domain Workstation Domain Workstation Domain Workstation Domain Workstation Active Directory Users Administrator Randy Gary Sue Active Directory Groups Domain Users Managers Domain Controller Directory Groups Users Printer Users Directory Groups Users Scanner Users Directory Groups Users File System Users Directory Groups Users HR Users

8. Discretionary Access Control List (DACL) Managers Read and Execute, Write Users Read and Execute Sue Full Control, Member of Users Glenn Deny Write, Member of Users, Managers SalesData.xml Glenn Sue Effective Permissions Read and Execute Effective Permissions Full Control Access Control Entries (ACEs)

9. IIS Security

10. Browser Client Web Site Server Initiate Conversation - Can we talk? Here is an encrypted session key Hi - here's my certificate containing the public key, signed by CA's private key Communication with session key Validate Digital Certificate

11. IIS Certificate Wizard

12. Certificate Backup

13. Certificate Restore

14. SSL Configuration

15. ASP.NET Authentication Run as User Account or IUSR Run Using Account (ASPNET) Internet Information Server Authentication IP and Domain Acceptable? User Authentication Impersonation Enabled? Yes No Perform ASP.NET Security Checks Check Windows DACL for Resource Permissions Request is Authorized - Respond to User

16. Browser Client Web Site Server 1. Request protected resource GET mydoc.aspx 3. Get login page - login.aspx?RETURNURL=/mydoc.aspx 5. POST login.aspx?RETURNURL=/mydoc.aspx 2. Redirect to login page http://www.site.com/login.aspx?RETURNURL=/mydoc.aspx 4. login.aspx 7. Redirect to mydoc.aspx with authentication cookie 6.Authenticate User 8. Request protected resource with authentication cookie GET mydoc.aspx 9. mydoc.asmx

17. Login Page

18. machine.config allow users="*" Web.config at / ( root ) Web.config at / ( root ) ( no entries ) Web.config at /customers allow users="Joe" deny users="*" Web.config at /customers/sales allow users="Mary" Web.config at /customers/sales/reports allow users="Mary,Joe" deny users="*"

19. AuthenticationType Name IsAuthenticated IIdentity AuthenticationType Name IsAuthenticated Ticket FormsIdentity AuthenticationType Name IsAuthenticated IsGuest IsSystem Token GetAnonymous( ) GetCurrent( ) Impersonate( ) WindowsIdentity AuthenticationType Name IsAuthenticated HasTicket GetProfileObject( ) PassportIdentity AuthenticationType Name IsAuthenticated GenericIdentity

20. Identity IsInRole( ) IPrincipal Identity IsInRole( ) WindowsPrincipal Identity IsInRole( ) GenericPrincipal

21. Forms Authentication Using Database Access

22. Populated Database

23. Database Access

24. Permissions Retrieve Evidence From Assembly Retrieve Evidence From Assembly Code Groups 3 Strong Name My_Computer_Zone Assign into Code Groups UNIONed Permissions Intersect Policy Permissions Enterprise Machine User Application Domain Code Access Security

25. Security Policy Administration

26. Testing Code Access Security

28. Lab Require Login to Customer site