Security :: Preventing Users From Accessing A Directory?
Jul 12, 2010
I have a web site with an administrative section. All administrative pages are stored in a directory called "db/administration". There is only one user that I want to have access to the pages in this directory. That user's username is "system". Currently, I am using the following approach in my web.config file:
[Code]....
When I logged in as another user, I was still able to access pages under db/administration when I navigated to them through the browser's address bar. What am I doing wrong?
We have a few scenarios which mean users can see other users data if they're on the same machine.
Scenario 1
Login User A Browse to forms with perosnal data Logout User A Login User B Either hit back button until you reach User A's personal data or.. Use browser history to jump directly to user A's personal data.
Scenario 2
Login User A Browse to forms with personal data Close browser New Browser, Use history to go directly to User A's data.
The 2nd one was caused by the browser displaying the page from its cache, so for that one, I added the following to the web.config..
[Code]....
[Code]....
which seems to do the trick, but I need to know how to fix the first part and whether the web.config changes are all that's needed to clear any cache.
A month ago I got everything working but now my code has changed and my server may have been misconfigured.
Basically, I'm running IIS 6.0 and Win2k 2003. The webserver will map a network path UNC share at: //wave/test
Also, I have webconfig set up to do: impersonate = true (no username/password defined)
the path //wave/test is another computer that runs Windows XP. Wave is the computer name, test is the folder name. So C: est is the folder to access. The current permissions under C: est on the file server is: Administrator, IUSR_WEB (read-only) and "Wave_user" (read-only)
Back in WinServer 2003, i've added a virtual directory and mapped to \wave est and applied a local username/password for Wave_user. I am able to see/browse all the files in IIS 6.0 and see the files/folders. I call the virtual directory alias: "Waves". Inside Authentication method for this virtual directory, i applied Wave_user and the local password of the local file-server PC , and checked enable anonymous access w/ integrated windows authentication.
Also, back in virtual directory, I set "Connect As" to wave est as username and password as the local password.
When I access the webapplication, using my current local PC credential, and try to access the network share, which in C# is the command: server.mappath@("wave"... i get a Server Error 401. in the browser.
I wonder if it's possible to use .NET to get access to users in Active Directory: - Methods that returns a collection of users belonging to a specific AD group - Get access to AD propterties beloning to the user account, want to check if the user account is disabled or not
I have a asp.net (3.5) web-app that will be used in an intranet. I need to enforce that users type in their network credentials (windows credentials) before they can log into this application. I intentionally need to disallow Integrated Windows Authentication. I need to authenticate these users against my company's Active Directory, that is obviously on the same network as my .net web app.
I have been reading a bit about Forms Authentication using ActiveDirectoryMembershipProvider - [URL]. I also stumbled upon this - [URL]. Based on what I can tell, both seem to do what I need to get done. Could somebody tell me what are the major differences, pros/cons and when you would use which method? Or are these exactly identical, and both achieve the exact same results?
From the security perspective...what do I need to watch for? I am assuming if I use SSL that will cover me for when I pass the username/pwd to AD for verification?
I want to know how to do Active Directory Authentication in my intranet web application,
So far I created a simple login page and I am using the login control. my questions are how do I configure the application, how do I interface the login control so it will take the user to next page once they input their usual active directory username and password.
I have some code that returns my LastPasswordSet date when I use my administrator account on my development machine using localhost but when I deploy to me test server and I get an exception "Object reference not set to an instance of an object" [Code].... [Code].... Any ideas?
I m writing a web page to display user name and his contact number.
I m giving user a choice to enter user name once he enter the name i should be able to search in active directory and return all user starting with (inputed name).
DirectorySearcher deSearch = new DirectorySearcher(de);
//set the search filter deSearch.SearchRoot = de;[CODE]....
Above code needs exact login name like adamjo which is not the purpose.i should be able to display all possible possibilities for example if user enters adam i should give him choice to select whether he want to see adam josef or adam john e.t.c.Is there any property to find first name from active directory?
I want to learn how to add/delete/update account (including adding mail boxes for new users). Can someone point to a good book where I can begin from. I want to start with some real basics and build from there.
have a probleme with my search filter, i want to list the users of an organizational unit result.filter =(& (objectClass= user)(ou=dep1)); ====> it didn't work for me
I want to use the Domain Users group to show all the users in a dropdown box. For some or other reason I cannot return all the users when looking for everyone under the domain so instead I was thinking of using the domain users group.This is part of my code:
I need to list a group of users, their group name is (IRS Group) to a list group. how to do this. I'm very new to asp.net and dont have much knowlegde about acctive directory.
This is how I added an email link on my page, but does .net have any built in tool for preventing Robots from finding this address? What is a good way to present an email link that wont be detected by spam robots?
The asp.net files are on 2008 server running IIS.From a client workstation (i.e. part of domain) I am running the website.Below code is part of the intranet website:
String ldapPathString = LDAP://abc.au.xyz.com:123/OU=User Accounts,DC=au,DC=xyz,DC=com; if(DirectoryEntry.Exists(ldapPathString)) \at this line, I am getting the error
I have written a code to get all the names from the active directory using the below codebut i am a user in "delhi" and by changing the domain name "mumbai" and "chenni" gives me username and names of the userin corresponding locations but the problem is i have published the web pages to the server in "mumbai" but then on onlythe details of mumbai user is getting is there a way around this
Problem: I am using FormsAuthentication.SetAuthCookie(UserId, False)[Snip]Response.Redirect("~/login_pages/home2.aspx") ' Force round trip so that logon works OK to logon a user. It all works fine with other browsers, and IE7 provided that IE7's PRIVACY (originally I had written "Security") setting is Low. However it doesn't work when the PRIVACY setting is Medium (the default).
How do I solve this problem? I would have expected that FormsAuthentication.Authenticate(Userid, password) was the solution, but this doesn't seem to work at all.
In one of my website I need to prevent direct access to non .aspx pages in a protected folder. Authentication works fine if I am going to [URL] but in one case my users are uploading html pages in that folder and if somebody cut and paste [URL]the page can be seen without the authentication process to be activated.
I am trying to retrieve all the users from active directory into a sorted list, but for some reason it does not return all the users like myself for instance. It's on a client's ad and there is probably about 1500+ users in AD.
