08 Asp.net Session11

Developing Web Applications Using ASP.NET Objectives In this session, you will learn to: Describe the authentication methods for Web applications Describe the authorization methods for Web applications Describe the main components of a membership system Describe how to build a security administration interface Configure authentication and authorization for a Web application Implement a membership registration page Implement a login page Create a membership management administrative user interface

Ver. 1.0

Slide 1 of 26

Developing Web Applications Using ASP.NET Authentication for Web Applications Authentication is the process by which users prove their identity. This usually involves entering a user name and a password. ASP.NET 2.0 provides three authentication mechanisms: Windows authentication Forms authentication Passport authentication

Ver. 1.0

Slide 2 of 26

Developing Web Applications Using ASP.NET Authentication for Web Applications (Contd.) Windows Authentication: Application can be configured to use Microsoft Windows authentication. IIS identifies the user by comparing the credentials entered by the user against the user’s Windows account. Three possible login methods are provided: Basic authentication Digest authentication Windows Integrated authentication

Ver. 1.0

Slide 3 of 26

Developing Web Applications Using ASP.NET Authentication for Web Applications (Contd.) Forms Authentication: Authentication is done on the basis of credentials entered by the user in the login page. Credentials can be stored in a Database (recommended) or in a Web.Config file (if number of users are less). By default, cookies are used to track the session of a user for subsequent requests. Query string can also be used in case cookie support is disabled in the client browser.

The following example shows how to configure Forms Authentication in the Web.config file :

Ver. 1.0

Slide 4 of 26

Developing Web Applications Using ASP.NET Authentication for Web Applications (Contd.) User accounts are typically stored in a database. It is possible to keep a list of users in the Web.config file: <user name="Kim“ password= "07B7F3EE06F278DB966BE960E7CBBD103DF30CA6"/> <user name="John“ password= "BA56E5E0366D003E98EA1C7F04ABF8FCB3753889"/>

Ver. 1.0

Slide 5 of 26

Developing Web Applications Using ASP.NET Authentication for Web Applications (Contd.) Passport Authentication: This is a centralized authentication service provided by Microsoft. Microsoft .NET Passport can be used to access services such as Microsoft Hotmail and MSN Messenger. Any site can be registered with the Passport service to use the same Passport for accessing the site. To use Passport authentication, following steps must be completed: 1. Obtain the .NET Passport software development kit (SDK). 2. Configure Passport authentication by adding the following element in the Web.config file : 3. Implement authentication and authorization by using the functionality in the .NET Passport SDK.

Ver. 1.0

Slide 6 of 26

Developing Web Applications Using ASP.NET Authorization for Web Applications Authorization is the process of determining the pages and resources that the user has access to after authentication. Authorization can be implemented using any of the following methods: File authorization URL authorization

Ver. 1.0

Slide 7 of 26

Developing Web Applications Using ASP.NET Authorization for Web Applications (Contd.) File Authorization: This is an authorization system provided by Windows. Permissions can be set on any file or folder stored on a disk formatted with the NTFS file system. These permissions are stored in Access Control List (ACL), which is stored with the file. The permissions stored in the ACLs can be used to control the access to the resources, pages, and folders in a Web application. To use File authorization: 1. Configure your application to use Windows authentication. 2. Assign permissions to the files and folders in the Web site.

Ver. 1.0

Slide 8 of 26

Developing Web Applications Using ASP.NET Authorization for Web Applications (Contd.) URL Authorization: Can be used to control access to each virtual directory within a Web site hierarchy. Can be used with any of the authentication modules. To establish permissions for a particular directory: Create a Web.config file within that directory. Add an section to the file that contains and <deny> tags for each user or role.

Two special values that can be used as wildcard identities in section: “*” : applies to everyone who visits the directory. “?” : applies to anonymous users.

Ver. 1.0

Slide 9 of 26

Developing Web Applications Using ASP.NET Authentication for Web Applications (Contd.) The following examples shows how to configure URL Authorization in an ASP.NET application: For a directory: <deny users="John"/> <deny users="?"/>

For a Single file: <system.web> <deny users="*"/>

Ver. 1.0

Slide 10 of 26

Developing Web Applications Using ASP.NET Introduction to Membership Microsoft ASP.NET membership gives a built-in way to validate and store user credentials. It can be used with ASP.NET Forms authentication or with the ASP.NET login controls to create a complete system for authenticating users. It supports facilities for: Creating new users and passwords Storing membership information in a data store Authenticating users Managing passwords Exposing a unique identification for authenticated users Specifying a custom membership provider

Ver. 1.0

Slide 11 of 26

Developing Web Applications Using ASP.NET Introduction to Membership (Contd.) ASP.NET 2.0 includes a set of classes that enable you to implement a membership system. You can use the Membership class to configure a membership system. The Membership class provides a range of methods for managing the members of a Web site: CreateUser DeleteUser UpdateUser ValidateUser FindUserByEmail FindUserByName

Ver. 1.0

Slide 12 of 26

Developing Web Applications Using ASP.NET How Membership Works To use membership, the site must be configured to use it by performing the following steps: 1. Specify membership options as part of your website configuration. 2. Configure the application to use Forms authentication. 3. Define user accounts for membership.

After configuring membership for your site, you must create a login form. Login form can be created by hand using TextBox controls or by using Login controls.

Ver. 1.0

Slide 13 of 26

Developing Web Applications Using ASP.NET How Membership Works (Contd.) Login controls are a set of Web server controls that provide the common user interface elements of a membership system. Login controls automatically use the membership system to validate a user. The following controls are available in the Login group of the Toolbox: CreateUserWizard Login LoginStatus LoginView PasswordRecovery ChangePassword

Ver. 1.0

Slide 14 of 26

Developing Web Applications Using ASP.NET How Membership Works (Contd.) In case login form is created by hand: You need to prompt the user for a user name and password and then call the ValidateUser method to perform the validation. You can call methods of the FormsAuthentication class after authentication to create a cookie and write it to the user’s computer.

After authentication is done, an object is created that contains information about the current user. This object can be used to retrieve information about the user, such as user’s name, email address, date, and time of last logon.

Ver. 1.0

Slide 15 of 26

Developing Web Applications Using ASP.NET Anonymous Users in the Membership System The membership system allows your application to accept and work with anonymous users. Before using anonymous identification, it needs to be enabled. A temporary ID is assigned to unauthenticated users to track their sessions. The ID is stored in a cookie or embedded in the URL of requested pages. If an anonymous user logs in, the anonymous identification information is discarded and the user is treated thereafter as an authenticated user.

Ver. 1.0

Slide 16 of 26

Developing Web Applications Using ASP.NET Membership Configuration and Management Membership system can be configured in the application’s Web.config file. The easiest way to configure and manage memberships is with the Web Site Administration tool. Specifications of membership configuration include: Membership provider to use Password options Users and passwords

Ver. 1.0

Slide 17 of 26

Developing Web Applications Using ASP.NET Web Site Security Administration Using the Roles Class Membership can be integrated with ASP.NET role management to provide authorization services for your site. Roles can be used to manage the permissions for large numbers of users. By grouping users into roles, permissions can be assigned once for many users. Roles and Authorization: In URL authorization mode, access to a directory can be configured by using the Web.config file in each directory. Roles can be added to the section as: <deny users="?"/> Ver. 1.0

Slide 18 of 26

Developing Web Applications Using ASP.NET Web Site Security Administration Using the Roles Class (Contd.) Role Management Configuration: Role management must be configured in the Web.config file in the root folder of the Web application. To enable role management, the following item can be included in the Web.Config file:

Ver. 1.0

Slide 19 of 26

Developing Web Applications Using ASP.NET Web Site Security Administration Using the Roles Class (Contd.) You can create and populate roles by: Using the ASP.NET Web Site Administration Tool Writing code by using the Roles class

Example of creating and populating roles by using the Roles class: Roles.CreateRole("Subscribers"); Roles.AddUsersToRole("Anatoly Sabantsev", "Subscribers"); Roles.AddUsersToRole("Bobby Moore", "Subscribers");

You can use the User object to check whether the current user is a member of a particular role: if (! User.IsInRole("Subscribers")) btnDownloadFile.Visible = false; Ver. 1.0

Slide 20 of 26

Developing Web Applications Using ASP.NET Demo: Controlling Access to a Web Application Problem Statement: You are a developer in the Adventure Works organization, a fictitious bicycle manufacturer. You have been asked to assist in the development of the Business-to-Consumer (B2C) Web application and a related Business-to-Employee (B2E) extranet portal. Decisions on the design of the application have already been made. You have been asked to carry out a number of specific tasks in order to implement various elements of this design.

Ver. 1.0

Slide 21 of 26

Developing Web Applications Using ASP.NET Demo: Controlling Access to a Web Application (Contd.) As part of the first phase of the B2C development, you have been asked to complete the prototypes for the following pages: • • •

• •

MembersLogin.aspx. This page collects and checks credentials to identify the user. Register.aspx. This page enables users to become members of the site. Employees.aspx. This page shows sales figures for the Adventure Works staff, and it should be viewable only by employees. MemberUpdate.aspx. This page enables users to change the email address and password stored for their account. Admin.aspx. This page enables site administrators to change the role membership on the site.

You will also ensure that several pages are secured properly.

Ver. 1.0

Slide 22 of 26

Developing Web Applications Using ASP.NET Demo: Controlling Access to a Web Application (Contd.) Solution: You need to perform following tasks: 1. Configuring Authentication and Authorization for a Web Application a. b. c. d. e.

Open the Adventure Works Web site for editing in Visual Studio. Implement Forms authentication for the Web application. Configure authorization for anonymous users and members. Configure IIS. Implement Windows authentication for the Employees page.

2. Implementing a Membership Registration Page a. b. c. d.

Ver. 1.0

Install the SQL Server provider database. Configure the ASP.NET SQL Server membership provider. Create the membership registration page. Create the membership update page.

Slide 23 of 26

Developing Web Applications Using ASP.NET Demo: Controlling Access to a Web Application (Contd.) 3. Implementing a Login Page and Adding Login Controls a. b. c. d.

Create the login page and add the Login control. Add a PasswordRecovery Web server control to the login page. Add login controls to other pages. Test the login and membership features.

3. Creating a Membership Management Administrative User Interface a. Configure the Web application to use the SQL Roles provider. b. Complete the Admin.aspx page. c. Secure the Administration page.

Ver. 1.0

Slide 24 of 26

Developing Web Applications Using ASP.NET Summary In this session, you learned that: Authentication is the process by which users prove their identity. In Microsoft Windows authentication, IIS identifies the user by comparing the credentials entered by the user against the user’s Windows account. In Form authentication, credentials entered by the user in the login page are checked with credentials stored in the database or Web.config file for authentication. Passport authentication is a centralized authentication service provided by Microsoft. Authorization is a process in which after authentication, the application determines the pages and resources that the user can access.

Ver. 1.0

Slide 25 of 26

Developing Web Applications Using ASP.NET Summary (Contd.) In File Authorization, access permissions can be set on any file or folder stored on a disk formatted with the NTFS file system. In URL authorization, access to each virtual directory can be controlled within the website hierarchy. The Membership class provides methods for creating, deleting, and updating user accounts, authenticating users, and managing passwords. Roles can be created to reduce the administrative overhead of managing permissions for large numbers of users.

Ver. 1.0

Slide 26 of 26