1. Created by : Asst. Prof. Ashish Shah
ASP.NET SECURITY

2. THREE INTERLIKED CONCEPT OF SECURITY W.R.T. ASP.NET
Created by : Asst. Prof. Ashish Shah
THREE INTERLIKED CONCEPT OF SECURITY W.R.T. ASP.NET
VIZ. AUTHENTICATION, AUTHORIZATION,IMPERSONATE. AUTHENTICATION: IT IS A PROCES OF SOME SORT OF IDENTIFICATION ARE OBTAINED FROM THE USERS AND USING IDENTIFICATION TO VERIFY OF HIM. THE DIFF. MODES OF IT ARE ACCEPTED THROUGH SETTINGS THAT CAN BE APPLIED TO THE APPLICATIONS WEB.CONFIG FILE, WHICH IS XML-BASED & ALLOW CHANGING OF ASP.NET BEHAVIOR EASILY.

3. THREE DIFF. PROVIDERS OF AUTHENTICATION
Created by : Asst. Prof. Ashish Shah
THREE DIFF. PROVIDERS OF AUTHENTICATION
GENERAL SYNTAX OF IT IS:
<system.web>
<authentication mode=“Windows|Forms|Passport”> </authentication>
</system.web>
WINDOWS: IT ALLOWS TO AUNTICATE USER BASED ON THEIR WINDOWS ACCOUNTS. THIS PROVIDER USES IIS TO PERFORM THE AUTHENTICATION AND THEN PASSES THE AUTHENTICATED IDENTITY TO YOUR CODE. IT IS A DEFAULT PROVIDED BY ASP.NET.
Syntex for it is as follows.
<authentication mode=“Windows” > </authentication>
<authorization>
<allow users=“*” />
</authorization>
note : if the user has supplied valied credentials access is only granted.

4. Windows authentication
Created by : Asst. Prof. Ashish Shah
Windows authentication
Four diff. Kinds of this options are as follows.
Anonymous: in this, IIS does not perform any authentication check & allows any user to access the application.
Basic: in this, windows user name and password have to be provided to connect.
Digest: this is same as basic but the password is hashed before it is sent across the network.
Integrated windows: in this password is not sent across the network and some protocols are used to authenticate users. It provides tools for strong cryptography which is used to secure information through out the network.

5. Created by : Asst. Prof. Ashish Shah
Forms Authentication
It provides a way to handle authentication using custom logic with application. It uses the cookie concept for authentication.
Configuration of web.xml for this type is :
<system.web>
<authentication mode=“Forms” >
<forms loginUrl-”login.aspx” name=“loginform” />
</authentication>
<authorization>
<deny users=“?” />
</authorization>
</system.web>
Note: for the anonymous user, acess is denied in the authorization section of above code. All users must enter their credentials using login form.

6. Passport Authentication
Created by : Asst. Prof. Ashish Shah
Passport Authentication
It allows microsoft passport service to authenticate users for application.
If users have signed up with passport and if authentication mode of application also passport then all authentication duties are offloaded to the passport servers.
It uses an encrypted cookie mechanism to indicate authenticate users.
If users have already signed into passport when they visit site then they will be considered as a authenticated users. Otherwise it will be redirected to the passport server to login. When they are successfully login then only they will be redirected to your web site.
Web.cofing is configured as follows:
<system.web>
<authentication mode=“Passport”>
<passport RedirectionUrl=“login.aspx” />
</authentication>
</system.web>

7. Created by : Asst. Prof. Ashish Shah
Authorization
Authentication & Authorization are two interconnected security concepts. First is process of identifying a user and authorization is the process of checking whether authenticated user has access to the resource which they requested.
Two form of Authorization:
File: it is performed by the File Authorization Module . It uses the access control list (ACL) of the .aspx file to resolve whether a user should have access to the file.
ACL permissions are confirmed for the users windows identity.
2) URL: in the web.config file you can specify the authorization rules for various directories of files using the <authorization> element.
Systex is :
<system.web>
<authorization>
<allow users=“abc” />
<deny users=“*” />
</authorization>

8. Created by : Asst. Prof. Ashish Shah
Impersonation
It is the process of executing code in the frame work of another user entity.
By default all asp.net code is executed using a fixed machin-specific account.
To execute code using another identity you can use the built-in impresonation capabilities of asp.net.
This technique allows the asp.net process to act as the authenticated user or as an arbitrary specified user.
It is controlled by <identity> tag in the applications web.config file.
The default setting of impersonation as false, as shown
<identity impersonate=“false” />

9. Created by : Asst. Prof. Ashish Shah
Impersonation
Now asp.net does not performs imporsnation. It means that asp.net will runs with its own previlliges. The second possible setting is to turn on impersonation as
<identity impersonate=“true” />
To impersonate a specific user for all the requests on all the pages of asp.net application, you can specify username and password attributes in the <identity> tag of the web.config file for that application as follows.
<identity impersonate=“true” username=“domain\username” password=“password” />