Asp.net security tutorial - contributed by Nihal Singh

You can use these different authentication modes by applying the settings to the application’s web.config file or in conjunction with the application server’s Internet Information Services (IIS) instance. A web.config file is another XML-based configuration file that resides in the root directory of the Web application. The settings applied in the web.config file override the same settings applied in the higher-level machine.config file. These XML-based files enable you to easily change how ASP.NET behaves.

The <authentication> Node in web.config file

You can enable a particular type of authentication for an application in an application’s root web configuration file.

<configuration>

<system.web>
                        <authentication mode=”Forms” />
</system.web>

</configuration>

Windows Authentication

Windows authentication is useful in an intranet environment (Within the organization). In a Windows-based authentication model, the requests go directly to IIS to provide the authentication process.

Allowing a single user through the web.config file

<system.web>
            <authentication mode="Windows" />
            <authorization>
                        <allow users="CrrerRide"/>
                        <deny users="*"/>
            </authorization>
</system.web>

In the above given example only user name “CrrerRide” will allow to use the resource and all other user users will deny to access.

The <allow> and <deny> nodes supports the following attributes.

Forms-Based Authentication

Forms-based authentication authenticates the user who wants to access an entire application or specific resources within an application. It is based on cookies where the user name and the password are stored either in a text file or the database. After a user is authenticated, the user’s credentials are stored in a cookie for use in that session.

Example:

Using forms-based authentication in your Web application is easy and simple the first step is to modify the web.config file in your application as given below.

Step 1:

<configuration>
<system.web>
                        <authentication mode=”Forms”>
                                    <forms>
                                                <credentials passwordFormat=”Clear”>
                                                            user name=”Career” password=”Ride” />
                                                </credentials>
                                    </forms>
                        </authentication>
                        <authorization>
                                    <deny users="?" />
                        </authorization>
</system.web>
</configuration>

The web configuration file contains a forms element that contains a credentials element. The credentials element includes a usernames and passwords. The question mark (?) symbol represents the all anonymous users.

Step 2:

Create an asp.net page name Login.aspx

Login.aspx has two simple TextBox controls and a Button control named as txtUserName, txtPassword and btnLogin respectively. When you click the Login button, the btnLogin_Click () method executes, and the FormsAuthentication. Authenticate () method checks whether the username and password entered into the TextBox controls match a username and password in the web configuration file. If the user successfully authenticates, the FormsAuthentication. RedirectFromLoginPage () method is called.

.

protected void btnLogin_Click (object sender, EventArgs e)
{
if (FormsAuthentication.Authenticate(txtUserName.Text,txtPassword.Text))
FormsAuthentication.RedirectFromLoginPage (txtUserName. Text, true);
else
lblError.Text = “User name or password is wrong”;
}

Passport Authentication

It is a centralize service provided by Microsoft. Passport Authentication allows users to create a single registration and get the user name and password to access any site that has implemented the Passport Authentication service. MSN and Hotmail uses the passport authentication. If you have done registration in MSN then you can access Hotmail with same user name and password without registration in Hotmail.

Implementation of .NET Passport Authentication Service

• Download the Microsoft .NET Passport SDK from the Microsoft Site.
• Register your application in .NET Service Manager.
• Get the SiteID and Application key after registering your application with .NET Services Manager.

Enable Passport Authentication in Web.Config

<configuration> 
            <system.web>
                        <authentication mode="Passport">
                        <passport redirectUrl="login.aspx" />
            </authentication>
            < authorization>
                        < deny users="?" />
            </authorization>
</system.web>
</configuration>