08 asp.net session11

1,214 views

Published on

Published in: Technology
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
1,214
On SlideShare
0
From Embeds
0
Number of Embeds
13
Actions
Shares
0
Downloads
0
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

08 asp.net session11

  1. 1. Developing Web Applications Using ASP.NETObjectives In this session, you will learn to: Describe the authentication methods for Web applications Describe the authorization methods for Web applications Describe the main components of a membership system Describe how to build a security administration interface Configure authentication and authorization for a Web application Implement a membership registration page Implement a login page Create a membership management administrative user interface Ver. 1.0 Slide 1 of 26
  2. 2. Developing Web Applications Using ASP.NETAuthentication for Web Applications Authentication is the process by which users prove their identity. This usually involves entering a user name and a password. ASP.NET 2.0 provides three authentication mechanisms: Windows authentication Forms authentication Passport authentication Ver. 1.0 Slide 2 of 26
  3. 3. Developing Web Applications Using ASP.NETAuthentication for Web Applications (Contd.) Windows Authentication: Application can be configured to use Microsoft Windows authentication. IIS identifies the user by comparing the credentials entered by the user against the user’s Windows account. Three possible login methods are provided: Basic authentication Digest authentication Windows Integrated authentication Ver. 1.0 Slide 3 of 26
  4. 4. Developing Web Applications Using ASP.NETAuthentication for Web Applications (Contd.) Forms Authentication: • Authentication is done on the basis of credentials entered by the user in the login page. • Credentials can be stored in a Database (recommended) or in a Web.Config file (if number of users are less). • By default, cookies are used to track the session of a user for subsequent requests. • Query string can also be used in case cookie support is disabled in the client browser. The following example shows how to configure Forms Authentication in the Web.config file : <authentication mode="Forms"> <forms name=“FormName" loginUrl=“/LogonPage.aspx" /> </authentication> Ver. 1.0 Slide 4 of 26
  5. 5. Developing Web Applications Using ASP.NETAuthentication for Web Applications (Contd.) User accounts are typically stored in a database. It is possible to keep a list of users in the Web.config file: <authentication mode="Forms"> <forms name=“LogonPage" loginUrl=“/LogonPage.aspx"> <credentials passwordFormat="SHA1"> <user name="Kim“ password= "07B7F3EE06F278DB966BE960E7CBBD103DF30CA6"/> <user name="John“ password= "BA56E5E0366D003E98EA1C7F04ABF8FCB3753889"/> </credentials> </forms> </authentication> Ver. 1.0 Slide 5 of 26
  6. 6. Developing Web Applications Using ASP.NETAuthentication for Web Applications (Contd.) Passport Authentication: This is a centralized authentication service provided by Microsoft. Microsoft .NET Passport can be used to access services such as Microsoft Hotmail and MSN Messenger. Any site can be registered with the Passport service to use the same Passport for accessing the site. To use Passport authentication, following steps must be completed: 1. Obtain the .NET Passport software development kit (SDK). 2. Configure Passport authentication by adding the following element in the Web.config file : <authentication mode="Passport"> 3. Implement authentication and authorization by using the functionality in the .NET Passport SDK. Ver. 1.0 Slide 6 of 26
  7. 7. Developing Web Applications Using ASP.NETAuthorization for Web Applications Authorization is the process of determining the pages and resources that the user has access to after authentication. Authorization can be implemented using any of the following methods: File authorization URL authorization Ver. 1.0 Slide 7 of 26
  8. 8. Developing Web Applications Using ASP.NETAuthorization for Web Applications (Contd.) File Authorization: This is an authorization system provided by Windows. Permissions can be set on any file or folder stored on a disk formatted with the NTFS file system. These permissions are stored in Access Control List (ACL), which is stored with the file. The permissions stored in the ACLs can be used to control the access to the resources, pages, and folders in a Web application. To use File authorization: 1. Configure your application to use Windows authentication. 2. Assign permissions to the files and folders in the Web site. Ver. 1.0 Slide 8 of 26
  9. 9. Developing Web Applications Using ASP.NETAuthorization for Web Applications (Contd.) URL Authorization: Can be used to control access to each virtual directory within a Web site hierarchy. Can be used with any of the authentication modules. To establish permissions for a particular directory: • Create a Web.config file within that directory. • Add an <authorization> section to the file that contains <allow> and <deny> tags for each user or role. Two special values that can be used as wildcard identities in <authorization> section: • “*” : applies to everyone who visits the directory. • “?” : applies to anonymous users. Ver. 1.0 Slide 9 of 26
  10. 10. Developing Web Applications Using ASP.NETAuthentication for Web Applications (Contd.) The following examples shows how to configure URL Authorization in an ASP.NET application: For a directory: <authorization> <allow users="Kim"/> <allow roles="Admins"/> <deny users="John"/> <deny users="?"/> </authorization> • For a Single file: <location path=“SecuredFile.aspx”><system.web> <authorization> <allow users="Joe"/> <deny users="*"/> </authorization> </system.web></location> Ver. 1.0 Slide 10 of 26
  11. 11. Developing Web Applications Using ASP.NETIntroduction to Membership Microsoft ASP.NET membership gives a built-in way to validate and store user credentials. It can be used with ASP.NET Forms authentication or with the ASP.NET login controls to create a complete system for authenticating users. It supports facilities for: Creating new users and passwords Storing membership information in a data store Authenticating users Managing passwords Exposing a unique identification for authenticated users Specifying a custom membership provider Ver. 1.0 Slide 11 of 26
  12. 12. Developing Web Applications Using ASP.NETIntroduction to Membership (Contd.) ASP.NET 2.0 includes a set of classes that enable you to implement a membership system. You can use the Membership class to configure a membership system. The Membership class provides a range of methods for managing the members of a Web site: CreateUser DeleteUser UpdateUser ValidateUser FindUserByEmail FindUserByName Ver. 1.0 Slide 12 of 26
  13. 13. Developing Web Applications Using ASP.NETHow Membership Works To use membership, the site must be configured to use it by performing the following steps: 1. Specify membership options as part of your website configuration. 2. Configure the application to use Forms authentication. 3. Define user accounts for membership. After configuring membership for your site, you must create a login form. Login form can be created by hand using TextBox controls or by using Login controls. Ver. 1.0 Slide 13 of 26
  14. 14. Developing Web Applications Using ASP.NETHow Membership Works (Contd.) Login controls are a set of Web server controls that provide the common user interface elements of a membership system. Login controls automatically use the membership system to validate a user. The following controls are available in the Login group of the Toolbox: CreateUserWizard Login LoginStatus LoginView PasswordRecovery ChangePassword Ver. 1.0 Slide 14 of 26
  15. 15. Developing Web Applications Using ASP.NETHow Membership Works (Contd.) In case login form is created by hand: You need to prompt the user for a user name and password and then call the ValidateUser method to perform the validation. You can call methods of the FormsAuthentication class after authentication to create a cookie and write it to the user’s computer. After authentication is done, an object is created that contains information about the current user. This object can be used to retrieve information about the user, such as user’s name, email address, date, and time of last logon. Ver. 1.0 Slide 15 of 26
  16. 16. Developing Web Applications Using ASP.NETAnonymous Users in the Membership System The membership system allows your application to accept and work with anonymous users. Before using anonymous identification, it needs to be enabled. A temporary ID is assigned to unauthenticated users to track their sessions. The ID is stored in a cookie or embedded in the URL of requested pages. If an anonymous user logs in, the anonymous identification information is discarded and the user is treated thereafter as an authenticated user. Ver. 1.0 Slide 16 of 26
  17. 17. Developing Web Applications Using ASP.NETMembership Configuration and Management Membership system can be configured in the application’s Web.config file. The easiest way to configure and manage memberships is with the Web Site Administration tool. Specifications of membership configuration include: Membership provider to use Password options Users and passwords Ver. 1.0 Slide 17 of 26
  18. 18. Developing Web Applications Using ASP.NETWeb Site Security Administration Using the Roles Class • Membership can be integrated with ASP.NET role management to provide authorization services for your site. • Roles can be used to manage the permissions for large numbers of users. • By grouping users into roles, permissions can be assigned once for many users. • Roles and Authorization: In URL authorization mode, access to a directory can be configured by using the Web.config file in each directory. Roles can be added to the <authorization> section as: <authorization> <allow roles="Admin"/> <allow roles="PowerUsers" /> <deny users="?"/> </authorization> Ver. 1.0 Slide 18 of 26
  19. 19. Developing Web Applications Using ASP.NETWeb Site Security Administration Using the Roles Class (Contd.) Role Management Configuration: Role management must be configured in the Web.config file in the root folder of the Web application. To enable role management, the following item can be included in the Web.Config file: <roleManager enabled="true" cacheRolesInCookie="true"> </roleManager> Ver. 1.0 Slide 19 of 26
  20. 20. Developing Web Applications Using ASP.NETWeb Site Security Administration Using the Roles Class (Contd.) You can create and populate roles by: Using the ASP.NET Web Site Administration Tool Writing code by using the Roles class Example of creating and populating roles by using the Roles class: Roles.CreateRole("Subscribers"); Roles.AddUsersToRole("Anatoly Sabantsev", "Subscribers"); Roles.AddUsersToRole("Bobby Moore", "Subscribers"); You can use the User object to check whether the current user is a member of a particular role: if (! User.IsInRole("Subscribers")) btnDownloadFile.Visible = false; Ver. 1.0 Slide 20 of 26
  21. 21. Developing Web Applications Using ASP.NETDemo: Controlling Access to a Web Application Problem Statement: You are a developer in the Adventure Works organization, a fictitious bicycle manufacturer. You have been asked to assist in the development of the Business-to-Consumer (B2C) Web application and a related Business-to-Employee (B2E) extranet portal. Decisions on the design of the application have already been made. You have been asked to carry out a number of specific tasks in order to implement various elements of this design. Ver. 1.0 Slide 21 of 26
  22. 22. Developing Web Applications Using ASP.NETDemo: Controlling Access to a Web Application (Contd.) As part of the first phase of the B2C development, you have been asked to complete the prototypes for the following pages: • MembersLogin.aspx. This page collects and checks credentials to identify the user. • Register.aspx. This page enables users to become members of the site. • Employees.aspx. This page shows sales figures for the Adventure Works staff, and it should be viewable only by employees. • MemberUpdate.aspx. This page enables users to change the e- mail address and password stored for their account. • Admin.aspx. This page enables site administrators to change the role membership on the site. You will also ensure that several pages are secured properly. Ver. 1.0 Slide 22 of 26
  23. 23. Developing Web Applications Using ASP.NETDemo: Controlling Access to a Web Application (Contd.) Solution: • You need to perform following tasks: 1. Configuring Authentication and Authorization for a Web Application a. Open the Adventure Works Web site for editing in Visual Studio. b. Implement Forms authentication for the Web application. c. Configure authorization for anonymous users and members. d. Configure IIS. e. Implement Windows authentication for the Employees page. 2. Implementing a Membership Registration Page a. Install the SQL Server provider database. b. Configure the ASP.NET SQL Server membership provider. c. Create the membership registration page. d. Create the membership update page. Ver. 1.0 Slide 23 of 26
  24. 24. Developing Web Applications Using ASP.NETDemo: Controlling Access to a Web Application (Contd.) 1. Implementing a Login Page and Adding Login Controls • Create the login page and add the Login control. • Add a P a s s w o r d R e c o v e r y Web server control to the login page. • Add login controls to other pages. • Test the login and membership features. 2. Creating a Membership Management Administrative User Interface a. Configure the Web application to use the SQL Roles provider. b. Complete the Admin.aspx page. c. Secure the Administration page. Ver. 1.0 Slide 24 of 26
  25. 25. Developing Web Applications Using ASP.NETSummary In this session, you learned that: • Authentication is the process by which users prove their identity. • In Microsoft Windows authentication, IIS identifies the user by comparing the credentials entered by the user against the user’s Windows account. • In Form authentication, credentials entered by the user in the login page are checked with credentials stored in the database or Web.config file for authentication. • Passport authentication is a centralized authentication service provided by Microsoft. • Authorization is a process in which after authentication, the application determines the pages and resources that the user can access. Ver. 1.0 Slide 25 of 26
  26. 26. Developing Web Applications Using ASP.NETSummary (Contd.) In File Authorization, access permissions can be set on any file or folder stored on a disk formatted with the NTFS file system. In URL authorization, access to each virtual directory can be controlled within the website hierarchy. The Membership class provides methods for creating, deleting, and updating user accounts, authenticating users, and managing passwords. Roles can be created to reduce the administrative overhead of managing permissions for large numbers of users. Ver. 1.0 Slide 26 of 26

×