Security :: Asp.net Mvc And Webforms Shared Authentication?
Oct 7, 2010
I have few websites based on the WebForms and one based on MVC. All websites have the same settings for forms authentication in web config.The problem is that once logged in to WebForms website, I have to re-login for MVC websites, but when I log out from MVC website, I am automatically logged out from WebForms websites.How can I pass information to the MVC website that user was successfully logged in when using WebForms.
I have few websites based on the WebForms and one based on MVC. All websites have the same settings for forms authentication in web config.
The problem is that once logged in to WebForms website, I have to re-login for MVC websites, but when I log out from MVC website, I am automatically logged out from WebForms websites.How can I pass information to the MVC website that user was successfully logged in when using WebForms.
I'm looking to implement my own basic webforms authentication. I don't want to use the 'membership' features in this case because I don't want to modify the database schema with all the membership elements that I won't use, and I don't need to support users across multiple applications. I want to wind up with one simple 'users' table that has username, password, passwordSalt, and several other fields to support custom user attributes specific to this application.
but it's rather dated... is this still valid? I'm looking for guidance on what I need to do to implement a custom webforms auth solution. A very basic skeleton I can expand upon, or a good tutorial/guide that illustrates the necessary parts... just the basics..
I got a ASP.Net webforms app which is using Forms authentication. It needs to authenticate against a webservice which uses windows authentication (+ impersonation).
I've tried (amongst other things) to supply credentials by using: service.Credentials = new NetworkCredential(myUserName, thePassword, theDomain)
The problem is that I get 401 from the webservice no matter what I try.
i developed an asp.net(2.0) applicaions which contains the attachments of the clients . these attachments are saved in the shared folder and retrive the file when the user requests.if i maintain the application and the shared folders in the same system it will work properly.if i maintain the application in one server and the file folder in the other server i face a lot of security issus like1.Access Denied2.Couldnot find the part of the path......for this i made an common account for the application server and the file server and also set impersonation to true.Even the i got the couldnot find the part of the path error.i already gave the everyone with full control to the shared folder and i added the common account and gave it to full controlIs there is any alternate for the save and retrive the files to and from the shared folder.
This could be very straight forward for some of you, but I got caught up. I am doing very simple test - browsing from IIS Manager to see the default page or "under Construction", however I am being challenged to provide my login credential . When I provide my login credential, I am able to see the default page. I wanted to see the default page without providing my credential since Enable anoymous access + basic authentication I am simply wanted to see the default page asit is working on other servers except this one. I have included screen print to make sure may question is clear.
I set authentication mode to Windows in the web.config and I enable Windows Authentication and disable the Anonymous Authentication in IIS 7 on win 7, but HttpContext.Current.User is always null.It works fine when I host the web app in IIS 6.0.
I have a web farm web project, and want to make sure windows authentication is working well without any problem in web farm, can any one give me some web sites or information about that?
I needed information regarding the capabilities & integration of AzMan tool with Asp.net.Currently, I got a Sharepoint 2007 website along with ASP.NET 2008 where I am using Form Based Authenication.Now, the requirement is any user within a domain registered in AD should be able to login in website through intranet.
Can I acheive this using AzMan, or I need to create two websites one with FBA for internet users and the other one for the intranet users with AD authenication. Also my intenet website is deployed and in use where usermapping and roles are already created, so using this tool what will be the impact on existing webiste.
I am trying to access a shared folder which is located on a different server rather than on the asp.net server.
I configured windows authentication and set impersonation to true. Also try with enable/disable basic authentication.
I have tried the following:
with a mapped driveshared folder access (\sharedfolder)virtual directory pointing to shared folder with pass through configuration. However none of the above works. I am getting "Access Denied" error when trying with shared folder and virtual directory. In the case of mapped drive getting "Not Found" error.
My web.config contains passwords to my database and smtp and i want to tighten up the security, i want to protect the passwords fully so if a hacker or webhost employee accessed all the webserver files the passwords cannot be easily accessed
I run on a shared host so using encryption could be an issue as i havnt got full IIS access - i havnt gone down that road yet to look fully into it
I was thinking it might be easier and secure enough if i moved the connection strings & passwords from the web.config into a referenced .dll which was protected by a professional obfuscation tool
After moving my web site from my local development environment to a shared host I get:
Security Exception
Description: The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission your system administrator or change the application's trust level in the configuration file.
The problem occurs in my web application everywhere the following is called:
Since my web application is only trying to open it's own web.config file, I don't know why this is flagged as a security exception. Maybe someone can explain... But more importantly I need a solution, the couple solutions I found via Google are painful.
Server A exists on domain A and server B exists on domain B. From server A I need to output file names that exist on shared folder on server B. I tried the following with no success (Access denied error):
DirectoryInfo dir = new DirectoryInfo(@"\serversharedFolder");
After some Googling I found that I need to use personlization to impersonate an existing user on Server B that has access to that shared folder. I used a C# personlization class as explained on codeproject (http://www.codeproject.com/KB/cs/cpimpersonation1.aspx). I supply the domain, the user, and the password and hope to get access to the shared folder BUT the error I see now is"Login failure: unknown user or bad password".
I am 100% sure that the domain, user, and password I supplied are correct. When trying to access the share via windows explorer from server A I am prompted for a username and password. After entering domainusername and the password I have access to the folder. So I know that the credentials I supplied are correct.
Am I going about this the right way? I have full access to server A and B so maybe there is an easier way to accomplish my goal.
I have developed the authenticated rss feed using the basic http authentication for my site.I also have the admin module for the site which uses the Asp.net Forms Authentication .Both are in the same project.When i turn on the forms authentication module to None in my web.config.My rss feed authentication works fine(the browser pop up the dialog box for the username and password) and upon entering the username and password the rss feed gets displayed.But with forms authentication turn on when i click the rss feed link i am getting redirected to the administrator login page.
If i set my authentication mode to none than the feed works like dream but the admin module do not work as it uses forms authentication.
How can i resolve the conflict for that one.I am using the asp.net mvc filter on my feed contoller to pop up the dialog box for the username and password.
I'm developing an internal booking sytem. Users log in to the sytem and can view existing bookings and search for bookings. They can also create new or edit existing bookings. When completing such actions I need a confirmation prior to completing the booking or updating the recorded. The confirmation is based on a reauthentication of the user.... in otherwords he needs to enter his passord again.
How can I achieve this? The system is internam and I'm using Forms Authentication. I an also using roles as som of the admin forms can only be viewed by administrators.
i have a situation where i need to develop a web system where sys. admin can create a shared folder in server and set who can access the shared folder programmatically.
i've manage to find example to create a shared folder from here:[URL]
and i also manage to find example to add user and set folder Security setting from here:[URL]
My problem is how can i add user in the Sharing permission setting since it is a shared folder. Default sharing setting is set to 'everyone'. This mean anyone in my company can browse to the shared file unless i set everyone security setting. I want to remove "everyone" and add users based on the user that i've already add at Security setting.
I have develop an ASP.NET website and I want store some uploaded files in a shared location in some different server. On that server one user has the access.
how it is possible to get the access of the shared location on the server with my Web site?
I received some code, a small c# asp.net application which manually posts a shared username/pwd to a 3rd party website for auto-logins from our intranet site. During transit the password is encrypted, but not within the application. Within this application a namevaluecollection is used and the username and password are hard coded. Originally the thought was, who cares if its hard coded because its shared between everyone anyway. Now we want to encrypt the username and password from within the application. I'm not sure the best way to accomplish the goal of making sure the password is encrypted "at rest". Normally I've seen passwords stored and encrypted within a database. I know we'll obviously have to move the password out of the application and store it somewhere else, I'm just not sure where. Do we move the username and pwd to the web.config file? I really am not sure the best way to approach this.
when I am trying to run the asp.net application from the shared location(not from the local machine), I have encountered a security exception as 'request for the permission of type 'system.web.aspnet hosting permission'. I have given the full trust rights to share folder.. but still I have got the same error..
