Security :: Web.config Authorization Roles With Local Groups With Domain Groups In Them
Sep 29, 2010
I am "DomainMyDomainUserName" If I do this:
[Code]....
I can access the website I've created on my local machine in debug mode; and with my domain account as a local administrator, if I do this:
[Code]....
I can still access the website; and with my domain account in a Domain Group named "DomainDomainLocalSecurityGroup", if I do this:
[Code]....
I can still access the website; HOWEVER, if I create a Local Group on my machine named "LocalMachineGroup" and I add "DomainMyDomainUserName" to this group and I do this:
[Code]....
I get an Access Denied error trying to access the website. What I want to do is, have a group on my local machine (for testing), on a test web server, and on a production web server named "MyWebsiteUserAccess" with the same Domain Group (filled with Domain Users allowed access to the site) in all of these local groups; so that when I test the web application on my local machine, on my test web server and on my production web server, I don't have to change the Web.config file to have it work on each AND if the Domain Group name ever has to change, it won't affect access to the website.
What am I overlooking or is this even possible to do this way? I understand that there is a way to do Role Management through ASP.NET but I don't understand that well enough yet to implement that (and will probably go that route once I've done the research on how to best implement it for purpose of access control of this intranet site).
View 2 Replies
Similar Messages:
Dec 18, 2010
i have a code to get the groups a user belongs to.
try
{
DirectoryEntry adRoot = new DirectoryEntry(string.Format("WinNT://{0}", Environment.UserDomainName));
DirectoryEntry user = adRoot.Children.Find(completeUserName, "User");
object obGroups = user.Invoke("Groups");
foreach (object ob in (IEnumerable)obGroups)
{
// Create object for each group.
DirectoryEntry obGpEntry = new DirectoryEntry(ob);
listOfMyWindowsGroups.Add(obGpEntry.Name);
}
return true;
}
catch (Exception ex)
{
new GUIUtility().LogMessageToFile("Error in getting User MachineGroups = " + ex);
return false;
}
the above code works fine when i have to find the groups of a local user but
for a domain user it returns a value "Domain User" which is kind of wierd as it is a part of 2 local groups.
Research
I did some finding and got that i am being returned the primary group of the domain user
called "Domain User" group
but what i actually want is the groups of the local machines the domain user is a part of... i cannot get that.. any suggestions
another code using LDAP
string domain = Environment.UserDomainName;
DirectoryEntry DE = new DirectoryEntry("LDAP://" + domain, null, null, AuthenticationTypes.Secure);
DirectorySearcher search = new DirectorySearcher();
search.SearchRoot = DE;
search.Filter = "(SAMAccountName=" + completeUserName + ")"; //Searches active directory for the login name
search.PropertiesToLoad.Add("displayName"); // Once found, get a list of Groups
try
{
SearchResult result = search.FindOne(); // Grab the records and assign them to result
if (result != null)
{
DirectoryEntry theUser = result.GetDirectoryEntry();
theUser.RefreshCache(new string[] { "tokenGroups" });
foreach (byte[] resultBytes in theUser.Properties["tokenGroups"])
{
System.Security.Principal.SecurityIdentifier mySID = new System.Security.Principal.SecurityIdentifier(resultBytes, 0);
DirectorySearcher sidSearcher = new DirectorySearcher();
sidSearcher.SearchRoot = DE;
sidSearcher.Filter = "(objectSid=" + mySID.Value + ")";
sidSearcher.PropertiesToLoad.Add("distinguishedName");
SearchResult sidResult = sidSearcher.FindOne();
if (sidResult != null)
{
listOfMyWindowsGroups.Add((string)sidResult.Properties["distinguishedName"][0]);
}
}
}
else
{
new GUIUtility().LogMessageToFile("no user found");
}
return true;
}
catch (Exception ex)
{
new GUIUtility().LogMessageToFile("Error obtaining group names: " + ex.Message + " Please contact your administrator."); // If an error occurs report it to the user.
return false;
}
this works too but i get the same result "Domain Users" . Please can some1 tell me how to get the local machine groups...?
View 2 Replies
Feb 7, 2011
I need to create a site that is Roles based and can use AD groups and Users. I found Scott Mitchell's tutorials for setting up "role-based-authorization-cs" [URL]
I've changed to using Windows auth. instead of forms and am pointing it to a remote SQL Database. I can successfully add a user/password/email etc. (although I believe the password and email sections aren't required and would like to remove them as options).
When I create a user (usera) and login to a windows box as usera the menu displays correctly based on the Roles I've added the user to in the SQL Database.
When I add an AD Group and add it to the same Role the menu's that are displayed do not match that of usera.
I'd like to be able to add entire AD groups (They can obviously change so it needs to be dynamic in some way), as well as add individual AD users to Roles. I'd prefer to do this via a Web interface.
My questions are.
1. Am I going about this the right way?
2. If I'm not what would be a better way?
3. If I am what do I need to do to allow ADGroup lookup?
View 2 Replies
Jan 6, 2011
How can I configure my web.config file so that my login page can serve domain users in a local group on the server? It's easier for us to modify members of the group on the server than having someone else do it on a domain group that we don't have access to.
View 7 Replies
Feb 1, 2011
I have a user that when I attempt to enumerate her groups using either System.Security.Principal.WindowsIdentity.GetCurrent().Groups on user's computer
or System.Web.HttpContext.Current.Request.LogonUserIdentity.Groups on the IIS server, I get a list of their old groups, not their new. I have checked the DC that they authenticate to and the ASP.NET page is running inside a SharePoint instance so the LogonUserIdentity most like is being provided from there Kerberos ticket.
Should I be looking up the groups directly from the AD instead of relying on the WindowsIdentity or LogonUserIdentity?
View 1 Replies
Mar 31, 2011
In asp.net/c#, is there a way to find all of the AD level user groups from a given domain in which the logged in user belongs to? E.g. I have a domain level user and few groups. I want to pass in the domain name and the logged in user's user name and get a list of AD groups of that particular domain.
View 2 Replies
Mar 29, 2011
I am using ASP.NET MVC 3 and am trying to do something that should be really straight forward...
My application uses Forms authentication and that is working perfectly for controllers/actions. For example if I decorate either a controller or an action with the attribute below only members of the administrators group can view them:
[Authorize(Roles="Administrators")]
However I have a folder under the default Scripts folder called Admin. I only want members of the Administrators group to be able to access scripts within this directory so I created a new web.config in the directory with the following inside:
[code]....
However no matter whether a user is a member of the Administrators group or not they receive a 302 Found message and are then redirected to the login page.
If I change the web.config to allow user="*" then it works. It also works if I add an allow users="Username" for a specific user I am testing with.
View 1 Replies
May 6, 2010
I am utilizing local security groups to secure my application and I need to list all the available groups on the local machine. I can get the list of groups a user is a member of, but I need the complete list of available groups.
View 1 Replies
Mar 8, 2010
I've built a asp.net 3.5 web application and want to be able to restrict access to particular pages. I have pages which should be able to be accessed by a user and then an adminshould be able to access all pages. I have created 2 Active Directory groups, one for normal users and one for admins so any users in the user group can see some pages then admins should have no restrictio
View 1 Replies
Jun 21, 2010
I have created a role based menu for my asp.net 3.5(C#) by configuring Asp.Net Membership module for site. My role based menu is a nested HTML unordered list. And each list item has a list of links. And at the end a list item has SignOut link. I have created 5 role groups for my website and put this list(i.e. menu) inside the contentTemplate of each and every role group.
I have display the SignOut link by using LoginStatus but I dun want to put the Login Status in each and every Roles Group. Can anybody tell me how to create a generic view which will display the Signout link when any user is logged-in. But I dun want to show the SignIn link when the user is not logged-in.
View 2 Replies
Apr 29, 2010
Is it possible to specify that multiple roles are required inside the authorization element of the web.config file? I currently have this block in one web.config of my site for a specific directory:
<authorization>
<allow roles="Global, Region" />
<deny users="*" />
</authorization>
I've just identified a special case where a person with two lower-level permissions than Global and Region should also have access to this directory. Roughly, I want something like this:
<authorization>
<allow roles="GlobalManager, RegionManager, SiteManager && FooSite" />
<deny users="*" />
</authorization>
I realize I probably should have a new role for this scenario, but I'd like to avoid that.
View 1 Replies
Feb 28, 2011
We're writing an app that has a requirement for allowing/disallowing access based on user role.In a traditional .net app of course you set the security trimming attribute in the web.config and set the nodes in the web.sitemap file and you were set.
View 2 Replies
Aug 12, 2010
Where can I find a good tutorial on setting up roles and authorizing them? I'm using Windows Authentication for an intra-net based app and need to figure out how to grant the users access to the various pages.
View 5 Replies
Oct 21, 2010
I'm trying to use a custom Principal (with custom Identity) for security. This all works fine for logging in, out etc. I am now trying to limit access to unauthorised users within my code as follows:
[Code]....
Again, all is fine there. Except I need some more complicated rules, something along the lines of "Allow Admins. Allow Buyers, provided they have the correct department ID and are allowed to see this customer's credentials". All of that information exists within a database.
View 2 Replies
Jan 16, 2010
I have a client asp.net website that uses ASP.Net Membership, Roles and Profile providers and Login controls. I need to expand the application so was going to use WCF Workflows, the ASP.Net website will be hosted on a different server than the WCF Services so what I want to do is get the ASP.Net Website to auth via the WCF Service. So process will go:
ASP.Net Website ------------------> WCF Service ------------------> SQL Database (Membership, Roles, Profile, Workflow Persistence Data and Business Data)
I tried creating a custom Membership and Role providers but I have had problems managing the users (Membershipuser class) saying null when a vaild user has been return by the WCF Service as can access the properies but not the methods.
View 5 Replies
Oct 25, 2010
I wrote this to get the groups a particular user belongs to:
DirectoryEntry AD = new DirectoryEntry("WinNT://" + Environment.MachineName + ",computer");
DirectoryEntry user = AD.Children.Find(completeUserName, "user");
object obGroups = AD.Invoke("Groups");
foreach (object ob in (IEnumerable)obGroups)
{
// Create object for each group.
DirectoryEntry obGpEntry = new DirectoryEntry(ob);
listOfMyWindowsGroups.Add(obGpEntry.Name);
}
for (int j = 0; j < listOfMyWindowsGroups.Count; j++)
{
//ex
}
How is it possible to retrieve all the groups in windows and not just for a particular user?
View 2 Replies
Mar 22, 2010
basically i have a page with the followingtextbox1 button1 and required field1 /validator callout1textbox2 button2 and required field2 /validator callout2button1 needs to only call validation controls1 and button2 needs to call validation controls2. how do i do this. I'm not really sure what to search for so any links to a tutorial/explanation
View 3 Replies
Feb 15, 2010
in my application i going to validate the blood groups, can u tell me how can i validate blood groups.
View 1 Replies
Mar 14, 2011
I'm trying to determine if there is a Yahoo API that I can use to create authentication based on membership in a Yahoo Group for a non-Yahoo website writte in ASP.NET. Basically, if a person is a member of a particular group, then they would be able to Login to this website.
Our club has an existing Yahoo site, but we'd like to disconnect from Yahoo while retaining the emailing capability that it offers, and I'd like to keep the number of places to be members of to a minimum. So if a person signs up for the Yahoo group, I'd like them automatically be able to login to the non-Yahoo site without any other steps.
View 3 Replies
Mar 15, 2011
I use this code to get the groups of the current user. But I want to manually give the user and then get his groups. How can I do this?
[code]....
View 2 Replies
Mar 14, 2011
I have a Form like this.
UserID has to be validated when user clicks "Check Availability" and "Submit"
Hence "UserID" required field validator has to be assigned two grops.
As if now it is assigned only Group1
[code]....
I have already gone through How to validate against Multiple validation groups?
which talks about validating Group1 and Group2 when user clicks "Submit" which is a good alternate solution.
View 1 Replies
Mar 24, 2010
I have two validation groups: parent and child
I have an add button that needs to only validate the child validation group which is easily done. The save button needs to validate against the parent and child validation groups, both client side and server side. I think I know how to do it server side by calling the Page.Validate("groupname") method for each group, but how can it be done client side?
View 1 Replies
Aug 18, 2010
I have a ASP.NET Website project and I need to list all the users and their groups on my Windows system. I have set the identity impersonation to true and provided the username and password of the admin in the web.config. Where do I start?
Update:
I have the following code at the moment -
var machine = new DirectoryEntry("WinNT://<IP ADDRESS>");
foreach (DirectoryEntry child in machine.Children)
{
// get the child's group(s).
}
When I debug, I can see the list of users in machine.Children. How do I find the group(s) that this user belongs to?
View 2 Replies
Apr 2, 2010
I have a query that returns a pretty big result. I want to break the big set into several smaller sets to pass into a function. If i had a 100 records returned, how would i get 10 datasets?
View 1 Replies
Sep 8, 2010
I have a windows user accounts which i just created take XYZ for example.
This XYZ belongs to a User group and a custom group i created in Computer Management --> Local users and groups.
So in properties i see that the user belongs to the 2 groups.
Now i want to get those groups and display them. any suggestions???
i have done this but this is not right as it gives me the roles of SQL (i think)
here is what i did:
after logging in and impersonating i call the function
getUserGroups();
private void getUserGroups()
{
// collect the user domain and identity
string[] arr =
System.Web.HttpContext.Current.Request.
LogonUserIdentity.Name.Split('\');
// update the display to show
// the captured domain and user
if (arr.Length > 0)
{
new GUIUtility().LogMessageToFile("User Name" + arr[0].ToString());
new GUIUtility().LogMessageToFile("User Domain" + arr[1].ToString());
}
// create an arraylist and populate
// it with the list of groups that
// the current user belongs to
ArrayList al = new ArrayList();
al = GetGroups();
// check to see if the user belongs
// to a specific group and create
// a list of all of the user's groups
foreach (string s in al)
{
// add this one to the list
new GUIUtility().LogMessageToFile("Group" + s);
// check to see if the user
// belongs to a specific group
//if (s == "BXSWLT\SomeCustomGroup")
//{
// // change the label to show
// // there was a match
// lblMemberOfGroup.Text = "YES";
//}
}
}
public ArrayList GetGroups()
{
ArrayList groups = new ArrayList();
foreach (System.Security.Principal.IdentityReference group in
System.Web.HttpContext.Current.Request.LogonUserIdentity.Groups)
{
groups.Add(group.Translate(typeof
(System.Security.Principal.NTAccount)).ToString());
}
return groups;
}
the Result i get is:
9/8/2010 5:57:22 PM: User Name NT AUTHORITY.
9/8/2010 5:57:22 PM: User Domain IUSR.
9/8/2010 5:57:22 PM: Group Everyone.
9/8/2010 5:57:22 PM: Group BUILTINUsers.
9/8/2010 5:57:22 PM: Group NT AUTHORITYAuthenticated Users.
9/8/2010 5:57:22 PM: Group NT AUTHORITYThis Organization.
9/8/2010 5:57:22 PM: Group LOCAL.
View 1 Replies
