Security :: Mixed Authorization On One Website?
Aug 24, 2010
I have an ASP.NET application that can be installed with either Forms Authentication or Windows Authentication. All of my customers install using Windows Authentication. I use Forms Authentication in-house as it is easier for me to work with different clients. But enough about that.
I have a module as part of my application for Mobile Users. It displays a very simple HTML interface for low bandwith phones and air cards. It seems that some phones when going to this type of site that is Windows Authentication, it throws an error saying that you aren't authorized to view the page. From a computer, it will ask for credentials.
What I would like to do is use Windows Authentication Or Forms for my Main Application, but in the MOBILE folder, it would be nice if I could use FORMS Authentication. Can I mix the two? Can I just add a Web.Config to the folder for the Mobile Files and put FORMS Authentication?
The only other way I thought of doing this is:
1) create a seperate installable application that is always FORMS Authentication that is not part of the main application. Which sucks, as I now have to manage two applications.
2) In the main Web.Config I can set that folder to have no authentication and it will be avail to anyone, and then enforce my own authentication on the few pages it contains.
View 1 Replies
Similar Messages:
Oct 18, 2010
Just to describe the scenario. I have a website. This lives on a webserver. On that webserver is an SQL server. The website connects to this database using windows authentication. I have written a windows form application that connects to the SQL Server on the webserver. This application is being run from a location on out intranet. The Winform application use SQL authentication to connect to the database. The SQL Server didn't have mix mode authentication enabled. So I enabled it. The winform application could now connect to the SQL Server.
This is where it starts getting a little strange.
The Website that was already connecting find using integrated authentication starts failing with:
Login failed for user 'NT AUTHORITYNETWORK SERVICE'
When you are enabling mixed mode authentication, you are adding another authentication method, why would the original Windows authentication fail?
View 1 Replies
Jul 8, 2010
I have a web application that requires two separate authentication and authorization.
In the root webconfig i configure the security for authenticating and authorizing public users
I also need authentication and authorization for the back end. That is the administrator who will manage the web application.
For this i have a subdirectory "admin" that will contain all the functionality for the back end. In the "admin" subdirectory i have a second web.config and i tried to add all the security for the administrator but it does not let me
Is it possible to have to separate authorization and authentication for a single web application. All the details will be save in microsoft's sql tables generate (for example aspnet... tables)
View 3 Replies
Jan 16, 2010
I have a client asp.net website that uses ASP.Net Membership, Roles and Profile providers and Login controls. I need to expand the application so was going to use WCF Workflows, the ASP.Net website will be hosted on a different server than the WCF Services so what I want to do is get the ASP.Net Website to auth via the WCF Service. So process will go:
ASP.Net Website ------------------> WCF Service ------------------> SQL Database (Membership, Roles, Profile, Workflow Persistence Data and Business Data)
I tried creating a custom Membership and Role providers but I have had problems managing the users (Membershipuser class) saying null when a vaild user has been return by the WCF Service as can access the properies but not the methods.
View 5 Replies
Apr 26, 2010
Our team has recently implemented a role permission based authorization so that we can have granular control. This is similar to what Rockford Lhotka suggests herehttp://www.lhotka.net/weblog/PermissionbasedAuthorizationVsRolebasedAuthorization.aspx I have also read about the Claims based authorization which to me looks very similar to what we have. Can some one put in simple terms what the advantages of claims based authorization are.
View 1 Replies
Jun 4, 2010
We have a web site with pages written in both vb and c#. We wish to move from a web site to a web application. As a web application cannot mix languages, my thought was to build two separate applications within the same solution and have the main(c#) reference the secondary(vb) and (somehow) copy the vb pages into corresponding places in the c# directory structure at build time.
View 1 Replies
Jan 13, 2011
I have a question about mixed mode authentication. I've been doing some research into this, but I haven't found the answer yet, so I figured I'd just ask:
I have an internal application that requires login. Right now it's using forms-based authentication. We'd like to make it so that, if you're internal and authenticated against Active Directory, you don't need to login to the application. However, if you're coming in from the outside (or don't have an AD account), it would then require them to login via the forms-based Login.aspx page.
From my research, it seems that the only way to do this is to enable forms based auth as the default membership provider, then on the back-end do a check at Page_Load to pull their login name, match it against the .NET membership and then authenticate them automatically - am I wrong on this?
The documents I've found all seem to point to the user having to login anyway, just the login being stored in AD - instead of having the user just login once to their machine in the morning and using that to verify them and their roles in subsequent applications.
View 4 Replies
Mar 3, 2010
I am working on a very basic ASP.Net 2.0 website that will have a backend based on SQL Server 2005. The website has three basic pages (Home, About, and Contact) that are fully viewable by everyone. However, there is a fourth page called "Employee Login" that must present a Login/Password system to the visitor of the page. Upon successful login, a few more pages shall become accessible to authenticated users only.I need the simplest Form based authentication here however; the User Names and their Passwords are going to be coming from the SQL Database. Setting up the authentication to Form simply locks out the whole website. I need the basic pages to be login-free. Only certain pages need a login.
View 3 Replies
Jan 20, 2011
I'm having a tough time implementing mixed-mode authentication (windows & forms based) for my application using IIS 7. Doing it in IIS6 is easy, but the process doesn't translate to 7/7.5 - and my research has led to me to conflicting answers, none of which.
I have redirect page called WindowsLogin.aspx, and a forms-based one called Login.aspx. I'm having difficulty enabling Windows authentication for just WindowsLogin.aspx.
View 1 Replies
Sep 30, 2010
Mixed Authentication Using IIS 7 On Windows Server 2008?
View 2 Replies
Jan 26, 2010
I created a mixed mode authentication mechanism based on a few of the articles that I have read on this topic. It's similar to something like this: [URL]
Basically, there are two web applications. One accepts the Windows Auth and one accepts Forms Auth. The Windows Auth then creates a forms auth ticket and passes control to the Forms auth application. This solution works fine when both applications are housed within the same IIS web site.
Now, order to control the security of this solution we set up multiple IIS web sites on the same machine. Web Site 1 serves external traffic (forms auth) and Web Site 2 serves internal traffic (windows auth).
So the design is that an internal user can hit the site using Windows auth via a internal name (myserver) while the external users use Forms Auth hitting [URL].
All that said, the solution works when the two applications are in the same site. Doesn't work when they are in different sites.
View 4 Replies
Apr 21, 2010
What is the authentication mode available in ASP.NET? How do you set authentication mode in the ASP.NET application? How do you provide secured communication in ASP.NET? List out the difference between windows authentication and form authentication. ?
View 3 Replies
May 18, 2010
I'm using Forms authentication in ASP.NET MVC website and I store user account login name in AuthCookie like this: FormsAuthentication.SetAuthCookie(account.Login, false); I want to ask if there is a possibility that user on client side will somehow manage to change his login name in AuthCookie and thus he will be for example impersonated as someone with higher privileges and authorized to do more actions than he is normally supposed to have. Also is it better to save in this cookie user account login name or user account ID number?
View 3 Replies
Feb 16, 2010
I'm using Visual studio 2005 with C# on .NET framework 2.0.. I am implementing forms authentication in this project but the problem is when I'm on registration form ( outside login) and try to open any window on that form using java script (window. open) it redirects me to login page. How should i tackle this problem??
View 1 Replies
Sep 30, 2010
I'm using a Custom Role Provider for authorization.
There are 2 roles: "VIEWER" and "SYSTEM_ADMINISTRATOR".
I have set up my role for my account as "VIEWER".
Roles.GetRolesForUser(this.User.Identity.Name) returns "VIEWER"
User.IsInRole("SYSTEM_ADMINISTRATOR") returns false
Web.Config contains below:
<location path="Administration">
<system.web>
<authorization>
<allow roles="SYSTEM_ADMINISTRATOR"/>
<deny users="*"/>
</authorization>
</system.web>
</location>
However, I can still access the ~/Administration pages.
Even if I change the web.config to:
<location>
<system.web>
<authorization>
<deny users="*"/>
</authorization>
</system.web>
</location>
I can still access any of the pages, but I shouldn't be able to access any page when this is set. Correct?
I'm pretty sure my Role Manager is working fine (see above calls to User and Roles), but here's the config:
<roleManager enabled="true" defaultProvider="MyRoleProvider" >
<providers>
<clear/>
<add type="MyNamespace.MyRoleProvider" name="MyRoleProvider"/>
</providers>
</roleManager>
I'm testing this on my local dev environment using Cassini and on a test web server running IIS 6. Both systems/sites work the same way and allow anyone access to any page. Both systems/sites also return correct data when programmatically checking Roles.GetRolesForUser and User.IsInRole.
View 1 Replies
Jul 2, 2010
Trivial question:
Noticed the following error whilst trawling the logs:
Authorization rule names cannot contain the '*' character
I have the code:
[Code]....
Does that mean I don't need to make and authorisation rules - I had used:
[Code]....
Now - is that completely redundant? Also, is * wrong syntactically?
View 2 Replies
Jun 28, 2010
I am looking for some suggestions for an application I am writing. Here is a brief description of the application:The application is written in C# ASP.NET version 4.0 and is to be hosted on an IIS6 web server. The purpose of the application is to serve as a download page for sensitive documents. There will be several levels of access which will be granted according to user credentials stored in a SQL table. I don't want the application to check the user's NT ID and either allow or disallow access to the application depending on whether they are authorized or not, I want it to filter on data i.e. everyone can view the application, it will just limit the data they can view depending on their access.
point me in the direction of some source code that can check the NT ID of user's local machines and compare it to a table in SQL?
View 2 Replies
Feb 28, 2011
We're writing an app that has a requirement for allowing/disallowing access based on user role.In a traditional .net app of course you set the security trimming attribute in the web.config and set the nodes in the web.sitemap file and you were set.
View 2 Replies
Mar 29, 2011
I am using ASP.NET MVC 3 and am trying to do something that should be really straight forward...
My application uses Forms authentication and that is working perfectly for controllers/actions. For example if I decorate either a controller or an action with the attribute below only members of the administrators group can view them:
[Authorize(Roles="Administrators")]
However I have a folder under the default Scripts folder called Admin. I only want members of the Administrators group to be able to access scripts within this directory so I created a new web.config in the directory with the following inside:
[code]....
However no matter whether a user is a member of the Administrators group or not they receive a 302 Found message and are then redirected to the login page.
If I change the web.config to allow user="*" then it works. It also works if I add an allow users="Username" for a specific user I am testing with.
View 1 Replies
Jan 30, 2010
i need clear expition for authentication and authorization in .net
View 3 Replies
May 26, 2010
which is the best method to create own customized login page?
i m not interested to use inbuilt controls, thts why m want to make own sign up pages and login page
View 3 Replies
Nov 30, 2010
I am going through the Security Tutorials here on ASP.Net. I am currently working on the last part of the Membership - User-Based Authorization. The tutorial covers restricting access to specific pages or to directories using a second Web.Config file. I am running into a problem with the myLogin page DestinationPageURL. Here is what is happening: 1. When the website starts, the Login page opens. 2. If I log in with an existing user, I am sent to the Default.aspx page. That is what is in the yLogin.DestinationPageURL for the login page.
View 1 Replies
Jan 26, 2010
A few years ago I worked with a team that developed what we thought, at the time, was a unique security model for a company ecommerce site. We wrapped every object (that we cared about) with a authorization / role check. So internal and external would use the same site but what fields, buttons, links etc. that they saw varied with their authorization / role assignments. I know .NET now has some RAD (Rapid App Dev) tools for security / authentication / authorization. Everything I have been reading is based upon securing pages / folders / areas of a site but nothing about the level of granularity we took it to so:
1. Was this not such as good way to go back when we did it?
2. I thought Microsoft had an entire security "plug-in" (Not Windows Authentication). Database, roles, etc.
(Don't get me wrong they have made life a ton easier with what they have given us)
3. What is the current method / practice in use for reasonably high security ecommerce environments. Cookieless Forms Auth? Something new altogether?
View 2 Replies
Aug 12, 2010
Where can I find a good tutorial on setting up roles and authorizing them? I'm using Windows Authentication for an intra-net based app and need to figure out how to grant the users access to the various pages.
View 5 Replies
Oct 21, 2010
I'm trying to use a custom Principal (with custom Identity) for security. This all works fine for logging in, out etc. I am now trying to limit access to unauthorised users within my code as follows:
[Code]....
Again, all is fine there. Except I need some more complicated rules, something along the lines of "Allow Admins. Allow Buyers, provided they have the correct department ID and are allowed to see this customer's credentials". All of that information exists within a database.
View 2 Replies
