Security :: Using Same User Store For Multiple Apps?
Oct 5, 2010
I have spent hours on the forum trying to find this answer. I have a requirement on a project. There is an internal (intranet employees only) site which has much more control over the data etc. and i have an external site (to allow customers to enter usage data). I am using forms auth and hitting a common sql server 2008 db with the standard aspnet schema. I have an internal web server and an external web server both windows 2003. The problem that i am having is that if you are logged into the external site and then open a new ie window and enter into the internal site, even as a different user it logs you out of the external and vice versa. I don't have access to update the machine config.
I started out as a single app in the db but now have seperated into 2 apps and i am able to log in as an external admin and see only the external users and vice versa. Creating a seperate security only db for the external app is not an option because i have a I have the application name listed in the web.config for both internal and external which matches the app name in the aspnet_applications table.
We have two different websites that run two seperate web sites (a backend and a front end) for our peice of software. The way we do our authentication is to put the user id into the session when the user logs in, all the pages on the site inherit from one base page if this base page cannot find this value in session it kicks the user out to the login screen.
What we want to be able to do is have a link on the front end after the user logs in and when they click on it it takes them(redirects them) to the back end. However I cannot think about how to do this in a secure and sensible way. I did think of putting the users username and password dynamically generated into the hyperlink that takes them from the front end to the back end. Would this be advisable. It will be clear text but then again we done use ssl in any case just plain forms authentication. I mean I will hash the values anyway but still be sending them. I suppose is there a way to share a session across two app domain without too much dificulty?
Our application lets the administrator create new users. Since the administrator is logged in, I have set Logincreateduser = false so that the administrator is not logged out even after creating the new user.
The problem is :I need the userid of the newly created user to store additional details of the user in another database table. I see that i can get the username using Createuserwizard1.username; but how do I get the userID?
I have a custom membership user class and custom MembershipProvider working against database. Due to security reasons the user passwords are stored in the database as hashed values. So my procedure
public override bool ValidateUser(string username, string password) is { //select hashed password from db return (EncodePassword(password) == dbpassword) } [code]....
Dragged and dropped a login control onto a blank content page. Set up my web.config (i'll include the code for that at the end). It seems to want to use a sql database to store the info. I just want to use the web.config since it's just a single user and a simple site. I thought I could just drag and drop the login control to a page and that would be the end of it (besides setting up the web.config).
Ive been exploring the tabls in the membership database to see how they are structured. If i add a new user or update an existing one i see it in the user and membership tables. But i dont understand how to use or store roles. I use the ASP.NET CONFIGURATION toll in the WEBSITE menu to create roles and create access rules, but those roles dont show up in the Roles table in the db!
Yet the roles are stored cause they keep apearing in the ASP.NET CONFIGURATION. How weird is not that? Where is it stored and how can i access it? I need to programatically check if the user who is logged in is in a certain role.
I'm trying to find out how i store user names and passwords in the web.config file. I have tried looking for documentation on this but haven't found any so far.
I see in the class library it says that the Authenticate method of the FormsAuthentication class is for use in authenticating credentials against those stored in the config file, but i don't know how to store them there to begin with. I want to store two username:password pairs in the web.config file preferably encrypted.
one of these username:password pairs i want to be hard coded. The other i want to be able to be reset with a password reset form which I will code later. I guess there maybe a method for creating a sername:password entry in the web.config which could be used with my password reset form if such a method exists. But I need to know how to hand code the username:password entries into the web.config file to begin with and to beable to create the hard coded pair.
code I need to add to my web.config file i need to add and in what section?
also can you point me in the direction of a method used for creating username:password entries in web.config
I have created an asp.net site with anonymous access turned off. Its for an internal (intranet) system which uses User.Identity.Name.ToString() to get the users login windows ID and then displays some records from a datagrid depending on their login ID. Is this secure? Also i am struggling to workout how best to store the result of User.Identity.Name.ToString() as I am not keen on storing it in a hidden text field and would rather not call it all the time unless this is the best way?
I like to create a new user webform. I like to have multiple textbox fields for the new user to enter and would like to use the inbuilt ASP SQl express to administer. I read somewhere to use Membership.CreateUser API but not sure what that is?
Is it as simple as dropping textbox in a webform and in webconfig options place a line of code?
I am evaluating ASP.NET Membership for an intranet Silverlight app. I want users to be automatically authenticated for my application with their windows logon. Thus I configured Windows Authentication. I would like to store user settings like email-address in using the SqlMembershipProvider and not AD. It seems that storing user settings using the SqlMembershipProvider is not supported with Windows Authentication. Is this really so (using .NET 4)?
If so: What is the rationale behind this? IMHO authentication, user settings and authorization are distinct aspects. User settings could easily be stored (identified by user name) using the SqlMembershipProvider with authentication and password management being supplied by Windows. What is the recommended solution for my scenario?
I have a design issue with a new project, the web application I'm developing is suppose to serve three different segments of business, each segment has a sligthly different requirement, but in all they share most of the same business needs, so I'm creating only one web application.
I've created three "Application" in the asp.net web administration tool.
I want to be able to create users related in each segment with their associated "Application" in membership store.
and when a users login(there is only one login pag) to the application to be redirected to his specified application.
The thing is the web.config configuration alows you to define one "Application" name, and hence the membership APIs pick up only that application.
I need to know how to change aspnetdb to store profile information unique to each user so that I can restrict records in an sql table to only show that user's records.
So if I make a "companyID" int, identity column where would I put it?
Also, when I write the where clause to companyID = profile (companyID) would that work?
I have read the post at http://forums.asp.net/t/1403132.aspx regarding login control. Is there a place to store the User logged-in ID (info) for later checking and use? I don't need to use the session object. I don't need the page to expire. I don't need the user to use a page saved in the favoites.
Is it better for a collection of ASP.NET web apps to share the same session database, or should each one have its own? If there is no significant difference, having a single database would be preferable due to easier maintenance. Background My team has an assortment of ASP.NET web apps, all written in either Monorail 1.1 or ASP.NET MVC 1.0. Each app currently uses a dedicated session state database. I'm working on adding a new site to that list, and am debating whether I should create another new session database, or just share an existing one with another app.
We have a server with lets say 5-10 internal ASP.NET (MVC) applications running in separate application pools as separate websites (on different ports and/or subdomains). I know nothing about the built-in ASP.NET authentication framework, so I was wondering if anyone could drop me a quick pointer in the right direction...
I want to secure all of the internal apps via one login mechanism (supporting 3-5 different roles; nothing complex). This login system would be another app/website running on the server, and to gain access to any other app, one must have authenticated via the one login system and the target app must be able to see the user's role. The internal apps will be modified at the code level to plug into this new login system (in other words, we'll modify the current apps to support the authentication).
The whole point of this is that I don't want each app to have its own login/authentication mechanism, but rather use a more "global" authentication system (everything on the same server). I am not looking for anything complex (just a company of 15-25 employees, 3-5 departments - each user must be associated with a department (role) based on their login - and each app will be tuned to show the user the appropriate data based on his role).
The question is - how do I make it so that a user's authentication status is visible across all of the different apps (in different assemblies and running separately)?
I maintain a college website. I also create various small web apps for the college (staff directory, online credit schedules, etc.). Currently, I have been using VS2010 and clicked on File - New Web Site - ASP.NET Empty Web Site for the main college website and File - New Web Site - ASP.NET Dynamic Data Entities Web Site for each of my apps.
Each is in its own separate directory in my development environment. The main site is "published" via VS2010's Copy Web Site tool in the Solution Explorer. The individual web apps are copied into unique physical directories on the Web server, and then via IIS7 Manager, a virtual directory is created on the college's web site for each app.
I have now run into a situation where I would like to create a new web app that utilizes some of the images and master pages from the college's web site. How do I create a New Web Site in VS2010 that can see/recognize/access the files from another web site? Namely, the college's main web site.
Want the forms based auth to persist (they use the same database for membership)
I tried to simply add a "." before the domain name in the forms tags (see below for example) - but this didn't work - it acutally prevented me from logging in at all. how i can persist the login? Does the admin need the same values for "name", "path" and "domain" as the main site?
This is my senario. I want user to login and if "LoggedIn" User has more than one role then it displays the list of radio buttons. After selection of the role user gets further privilages according to the role that he has selected.
I've a problem setting up the role. And user can change his role when ever he wants.
For Example "john" is the user having two roles "Account Manager" and "Project Manager".
I am working on site which requires to control user from its misusing. Say a user is login from 1 m/c the other user should not be able to login from other m/c with the same account, but user must be able to do multiple login of same user from the same m/c.
First I was hoping using the IP address check I will be able to do that but due to proxy many user will have a same IP address.
Requirment is to stop more than one user to login at a time using same user id.I am storeing user id in session. I searched the internet and found some ways but somehow they do not work in these situations:If javascript in brower is turned off. If user do not click logout and directly close brower.
I have users that belong to more than one role and I have a login view for those roles but I only see the first role's content.
How should I be going about getting to see all content for the roles that user is in? My user logs in and is a member of MACED and ADMIN but only sees the links for MACED
i have probleM to check the login ,but i found one solution in this site.. AVOID MULTIPLE USER LOGIN, ...IS THER ANY OTHER METHOD TO SOLVE THIS PROBLEM.....
Can anyone explain how to make unique login in asp.net
<b>Problem:</b> If user is logged at a client machine and tries to login from other client machine at the same time, then he should be prompted that "You are already logged in, Do you want to continue?" on continue user should be logged out from other machine and logged in to current machine.
