Security

ASP.
NET Security
By
SRIRAM. B
ASP.NET Security Overview
 Authentication &  Authentication & Authorization
Authorization  Login Controls
 Authentication Modes  Membership & Role

Management
 Windows
Authentication
 Forms Authentication
 Passport Authentication
 User Class
 Authorization
 Impersonation
Authentication &
Authorization
Authentication & Authorization
 Authentication is the process of obtaining some credential
from users and using those credentials to verify the users
identity.
 Authorization is the process of allowing an authenticated

user access to resources.
 Authentication always procedded to Authorization.

Authentication
Modes
Authentication Modes
 Windows
ASP.NET authentication services attach a WindowsPrincipal

(System.Security.Principal.WindowsPrincipal) to the current request
to enable authorization against NT users or groups.
 Forms
ASP.NET authentication services manage cookies and redirect

unauthenticated users to a logon page. This is often used in
conjunction with the IIS option to allow anonymous access to an
application.
 Passport
ASP.NET authentication services provide a convenient wrapper

around the services provided by the Passport SDK, which must be
installed on the machine.
Windows
Authentication
Windows Authentication
 It can be enabled by default. Users can be identified by the
windows account names, the roles corresponds to windows
groups.
 It delegates the responsibility of identifying users to IIS. IIS can be

configured to use the following authentications:- <authentication
mode = “Windows”/>
 Anonymous
If any one is allowed to access the ASP.NET application , IIS does

not perform any authentication
 Basic
User must provide a windows username and password to

connect. However the information is sent over the network in clear
text, It become in-secure for internet based applications.
Windows Authentication
 Digest
The user can provide the windows username and password to

connect. However the password is in hashed format before it is sent
across the network. The windows accounts to be stored in the active
directory.
 Windows Integrated
In windows integrated authentication, passwords never cross the

network. Users must still have a username and password, but the
application uses either Kebros / Challenge response protocols
authenticate the user. It will be used for intranet based applications.
Forms
Authentication
Forms Authentication
 ASP.NET authenticates users, redirects unauthenticated users to
the logon page, and performs all the necessary cookie
management. This sort of authentication is a popular technique
used by many Web sites and handle your own custom logic.
In web.config <authentication mode = “Forms”/>
 Using Form based authentication to denying access to

anonymous users
<configuration>
<system.web>
<authentication mode="Forms"/>
<authorization> <deny users="?" /> </authorization>
</system.web>
</configuration>
Forms Authentication..
 Administrators use forms-based authentication to configure the
name of the cookie to use, the protection type, the URL to use for
the logon page, length of time the cookie is in effect, and the path
to use for the issued cookie.
<authentication mode="Forms">
<forms name=".ASPXCOOKIEDEMO" loginUrl="login.aspx"
defaultUrl="default.aspx"
protection="All" timeout="30" path="/" requireSSL="false"
slidingExpiration="true" enableCrossAppRedirects="false"
cookieless="UseDeviceProfile" domain="">


</forms>
</authentication>
 After the application has been configured, you need to provide a
logon page. When it is run, it requests the Default.aspx page.
Unauthenticated requests are redirected to the logon page
(Login.aspx), which presents a simple form that prompts for an
e-mail address and a password. (Use
Username="[email protected]" and
Password="password" as credentials.)
 Default.aspx
Page Load -> Label1.Text = "Hello, " + User.Identity.Name;
Signout -> FormsAuthentication.SignOut(); Response.Redirect("login.aspx");
 Login.aspx
if ((UserEmail.Value == "[email protected]") && (UserPass.Value ==
"password")) {
FormsAuthentication.RedirectFromLoginPage(UserEmail.Value,
PersistCookie.Checked); }
else { Msg.Text = "Invalid Credentials: Please try again"; }

Forms Authentication
 Attributes :-
 Cookieless (UseDeviceProfile(default), Autodetect)
 DefaultUrl
 Domain
 EnableCrossAppRedirects
 LoginUrl
 Name
 Path
 Protection
 RequireSSL
 SlidingExpiration
 timeout
 Authentication Against Values in web.config file
<System.web><authentication mode = “Forms”>
<credentials passwordFormat="clear" > <user name="Bill" password="secret"/>

</credentials> </authentication>
<authorization> <deny users=”?”/> </System.web>
You can change the Login.aspx to work with web.config file

if (formsAuthentication.Authenticate(TextBox1.Text, TextBox2.Text)) {
FormsAuthentication.RedirectFromLoginPage((TextBox1.Text, True); }
else { Respose. Write( "Invalid Credentials: Please try again"); }
The following values of the passwordFormat attribute:

Hash Type Description
Clear Passwords are stored in cleartext
SHA1 Passwords are stored as SHA1 digests
MD5 Passwords are stored as MD5 digests

 Using Encrypted Passwords
<authentication>
<credentials passwordFormat="SHA1" >
<user name="Mary" password="94F85995C7492EEC546C321821AA4BECA9A3E2B1"/>
<user name="John" password="5753A498F025464D72E088A9D5D6E872592D5F91"/>

</credentials>
</authentication>
You can generate the hashed representation of the password by

using
FormsAuthentication.HashPasswordForStoringInConfigFile((TextBox1.Text,”S
HA1”);
Passport
Authentication
Passport Authentication
 Passport uses encrypted cookie mechanism to indicate
authenticated users.
 When your application is enabled for passport

authentication, the request is redirected to the Microsoft
Passport Site where the user can enter his credentials
 If the authentication is successful the user is authorized to

proceed and the request is redirected back to your
application.
User Class
User Class
 Page.User Class or HtttpContext.User property to retrieve the information about
the current user.
 The principal object also includes an Identity Property that enables you to get the
information about the current users identity. It supports the following properties:-
 AuthenticationType string authType = User.Identity.AuthenticationType;

 IsAuthenticated bool authUser = User.Identity.IsAuthenticated();
 Name string UserName = User.Identity.Name;
 The principal object supports the following Method: -
IsInRole()-> Enables you to check whether the user is a member of a particular

role.
If (User.IsInRole(“BUILTIN\Administrators”) ){ // Private Information }
else { // Public Information }
Authorization
Authorization
 Process of identifying the resources that you are allowed to
access. You can control authorization by adding an authorization
element to a web.config file. You can use authorization in the
same way for Windows, Forms & Passport
 To block the unauthenticated user
<authorization> <deny users=”?”/> </authorization>
 Authorization allows only for Bill and denies for others
<authorization> <allow users=”Bill”/> <deny users=”?”/>

<authorization>
 Authorizing by Role for Administrator
<authorization> <allow roles=”Administrator”/> <deny

users=”*”/> <authorization>
 Authorizing Files by Location
<location path = “Secret.aspx”>

Impersonation
Impersonation
 ASP.NET can execute the request using the identity of the
client, who is making the request is called impersonation.
<IDENTITY impersonate="true" />
 Identity is a webconfig declaration under System.web, which

helps to control the application Identity of the web
applicaton.
 It can be at any
level(Machine,Site,application,subdirectory,or page),
attribute impersonate with "true" as value specifies that
client impersonation is used.
Demo
Session Ends
Exercise
Relax

Security

Uploaded by

Copyright:

Available Formats

Security

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Security

Uploaded by

Copyright:

Available Formats

ASP.

 Authentication Modes  Membership & Role

 Authorization is the process of allowing an authenticated

 Authentication always procedded to Authorization.

ASP.NET authentication services attach a WindowsPrincipal

ASP.NET authentication services manage cookies and redirect

ASP.NET authentication services provide a convenient wrapper

 It delegates the responsibility of identifying users to IIS. IIS can be

If any one is allowed to access the ASP.NET application , IIS does

User must provide a windows username and password to

The user can provide the windows username and password to

In windows integrated authentication, passwords never cross the

In web.config <authentication mode = “Forms”/>

 Using Form based authentication to denying access to

Page Load -> Label1.Text = "Hello, " + User.Identity.Name;

Signout -> FormsAuthentication.SignOut(); Response.Redirect("login.aspx");

else { Msg.Text = "Invalid Credentials: Please try again"; }

<credentials passwordFormat="clear" > <user name="Bill" password="secret"/>

<authorization> <deny users=”?”/> </System.web>

You can change the Login.aspx to work with web.config file

else { Respose. Write( "Invalid Credentials: Please try again"); }

The following values of the passwordFormat attribute:

SHA1 Passwords are stored as SHA1 digests

MD5 Passwords are stored as MD5 digests

<credentials passwordFormat="SHA1" >

<user name="Mary" password="94F85995C7492EEC546C321821AA4BECA9A3E2B1"/>

<user name="John" password="5753A498F025464D72E088A9D5D6E872592D5F91"/>

You can generate the hashed representation of the password by

 When your application is enabled for passport

 If the authentication is successful the user is authorized to

 AuthenticationType string authType = User.Identity.AuthenticationType;

 The principal object supports the following Method: -

IsInRole()-> Enables you to check whether the user is a member of a particular

 To block the unauthenticated user

<authorization> <deny users=”?”/> </authorization>

 Authorization allows only for Bill and denies for others

<authorization> <allow users=”Bill”/> <deny users=”?”/>

 Authorizing by Role for Administrator

<authorization> <allow roles=”Administrator”/> <deny

 Authorizing Files by Location

<location path = “Secret.aspx”>

 Identity is a webconfig declaration under System.web, which

You might also like