Advice: Authentication

[PK]

Hi folks,

I hope to get some of your advice on an authentication question that
came up during the planning of web app. I'm a bit new to asp.net, so if
you can offer some experience, I'd greatly appreciate it!

I like form-based authentication because the usernames and passwords can
be stored in a database rather than in Windows (which, for security
reasons, can only be maintained by a specific person or two). Also, I'd
like to give my users the ability to log out, which is not something
I've seen in Windows authentication.

One of the main purposes of this app is to provide a search to find and
download (via resulting links) sensitive files. Forms/database
authentication is great for this, because the stored procedure that does
the search can be altered to make sure the logged-in username has rights
to download the results.

However, we would like to apply Windows security on the files to be
downloaded *just in case* a user navigates to the path of a file they
would otherwise not have permissions to. How can I mix the two types to
get what I want out of each -- without prompting the user to log in
twice!

Has anyone encountered a similiar issue?

Thanks!

PK

*** Sent via Developersdex [url]http://www.developersdex.com[/url] ***
Don't just participate in USENET...get rewarded for it!

[Jim Cheshire [MSFT]]

PK,

You first need to realize that you cannot set the authentication method
below the application root. If you want to control access to these files,
your best bet is to store them outside of the content area and then use
BinaryWrite to write a byte array to the HTTP stream. That way, you can
decide via code whether or not your BinaryWrite code should run and no one
will be able to browse directly to the files.

Jim Cheshire, MCSE, MCSD [MSFT]
ASP.NET
Developer Support
[email]jamesche@online.microsoft.com[/email]

This post is provided "AS-IS" with no warranties and confers no rights.

--------------------

>From: PK <philitsa.kontos@NO.na.SPAM.linedata.com>
>X-Newsreader: AspNNTP 1.50 (ActionJackson.com)
>Subject: Advice: Authentication
>Mime-Version: 1.0
>Content-Type: text/plain; charset="us-ascii"
>Content-Transfer-Encoding: 7bit
>Message-ID: <OLYwUe9IEHA.3988@tk2msftngp13.phx.gbl>
>Newsgroups: microsoft.public.dotnet.framework.aspnet.security
>Date: Fri, 16 Apr 2004 10:23:47 -0700
>NNTP-Posting-Host: actionjackson133.dsl.frii.net 216.17.147.133
>Lines: 1
>Path:

cpmsftngxa06.phx.gbl!TK2MSFTNGXA01.phx.gbl!TK2MSFT FEED01.phx.gbl!TK2MSFTNGP0
8.phx.gbl!tk2msftngp13.phx.gbl

>Xref: cpmsftngxa06.phx.gbl

microsoft.public.dotnet.framework.aspnet.security: 9662

>X-Tomcat-NG: microsoft.public.dotnet.framework.aspnet.security
>
>Hi folks,
>
>I hope to get some of your advice on an authentication question that
>came up during the planning of web app. I'm a bit new to asp.net, so if
>you can offer some experience, I'd greatly appreciate it!
>
>I like form-based authentication because the usernames and passwords can
>be stored in a database rather than in Windows (which, for security
>reasons, can only be maintained by a specific person or two). Also, I'd
>like to give my users the ability to log out, which is not something
>I've seen in Windows authentication.
>
>One of the main purposes of this app is to provide a search to find and
>download (via resulting links) sensitive files. Forms/database
>authentication is great for this, because the stored procedure that does
>the search can be altered to make sure the logged-in username has rights
>to download the results.
>
>However, we would like to apply Windows security on the files to be
>downloaded *just in case* a user navigates to the path of a file they
>would otherwise not have permissions to. How can I mix the two types to
>get what I want out of each -- without prompting the user to log in
>twice!
>
>Has anyone encountered a similiar issue?
>
>Thanks!
>
>PK
>
>*** Sent via Developersdex [url]http://www.developersdex.com[/url] ***
>Don't just participate in USENET...get rewarded for it!
>

[PK]

Actually, I found two great articles on this subject. The one I found
most useful was:

[url]http://www.dotnetbips.com/displayarticle.aspx?id=201[/url]

It's a great article about how you have the functionality of Windows
authentication with the behavior of Forms authentication using the Win32
API LogonUser().

Another is pretty good as well, but didn't cover exactly what I was
looking for is:

[url]http://msdn.microsoft.com/asp.net/using/understanding/security/default.a[/url]
spx?pull=/library/en-us/dnaspp/html/MixedSecurity.asp

*** Sent via Developersdex [url]http://www.developersdex.com[/url] ***
Don't just participate in USENET...get rewarded for it!