Expertrating - ASP.Net Tutorial, Begining Web Forms

Home > Courses, Tutorials & eBooks > ASP.NET Tutorial >Windows Based Authentication

ASP.NET Tutorial - Windows Based Authentication

Page 1 of 3

Windows NT and Windows 2000 implements security at the file system level. Every directory and file has an associated set of permission. These permissions are defined relatively to Window users and groups.

Note

To set permission on individual file you must have NTFS partitions.

Windows 2000 includes several default users and groups. For example, the administrator user account has the broadest set of possible permissions. The Administrator account is a member of the Administrator group. When configuring Windows authentication with ASP.NET, you will need to work with the following users and groups: -

ASP.NET

The user account for the ASP.NET worker process.

IUSER_MachineName

The user account used by Internet lnformation anonymous access. For example, if your Web server is named myServer, anonymous users of your Web site, access the server through the IUSER_myServer user account.

Users

This group, by default, includes the ASPNET user account.

Anthenticated Users

Operating system group. All authenticated users are automatically part of the Authenticated Users group. This group corresponds to every ones group account in Windows NT 4.0.

Minimally, in order to enable anonymous access to the files in a directory, you will need to grant Read & Execute permissions to two user accounts: the ASPNET and IUSER_MachineName user accounts. The ASPNET user account represents the ASP.NET worker process and the IUSER_MachineName account represents an anonymous, Information Server user.

Note

You can use IIS to change the account associated with anonymous users from the IUSER_ MachineName account to any other account. Modifications can be made to the anonymous user account within IIS by opening the property sheet for a directory, selecting the Directory Security tab, and clicking the Edit button under Anonymous Access and Authentication Control.

Since both the ASPNET and IUSER_MachineName user accounts are part of the Users group, the Authenticated Users group, and the Everyone group, access can be enabled for a directory, by simply granting Read & Execute permissions to one of these groups. For example, anonymous access can be enabled by granting Read & Execute permissions on a directory to the Users group.

Note

There is a special problem that you encounter when executing ASPNET on a primary or backup domain controller. Since a primary or backup domain controller cannot include non-adminstrative local accounts, on these machines the ASP.NET worker process must be configured to execute under the local system account.

If anonymous access to a directory has to be prevented, then IUSER_MachineName user account can be used from that directory. For example, if only the Administrator account has to be enabled to access the files in a directory the following steps are used:

1.Right-click the directory and select Properties.

2.Choose the Security tab.

3.Uncheck the checkbox labeled Allow inheritable permissions from parent to propagate to this object.

4.Remove every user and group except the ASPNET and Administrator users.

5.Click Advanced to open the Access Control Settings dialog box.

6.Check the checkbox labeled Reset permissions on all child objects and enable propagation of inheritable permissions.

7.Click OK to close the Access Control Settings dialog box.

8.Click OK to close the Properties dialog box.

As shown below: -

After the completion of these steps, a request of any file in that directory with the Web browser, a Login dialog box is displayed. Therefore you are forced to log in with a user account that has access to the directory (in this case, the Administrator user account).

You can provide any user or group with permissions to access any directory or file in your Web site. Simply add the user or group by using the Security tab associated with the file or directory.

ExpertRating ASP.NET Certification - Get Certified Now!!