Article ID: 306590 - Last Review: October 29, 2007 - Revision: 3.14

INFO: ASP.NET Security Overview

View products that this article applies to.
System TipThis article applies to a different operating system than the one you are using. Article content that may not be relevant to you is disabled.
This article was previously published under Q306590
This article refers to the following Microsoft .NET Framework Class Library namespaces:
  • System.Web.Security
  • System.Web.Principal

On This Page

Expand all | Collapse all

SUMMARY

This article provides an introduction to ASP.NET security.

For additional ASP.NET overviews, refer to the following Microsoft Knowledge Base article:
305140  (http://support.microsoft.com/kb/305140/EN-US/ ) INFO: ASP.NET Roadmap
Back to the top

MORE INFORMATION

ASP.NET gives you more control to implement security for your application. ASP.NET security works in conjunction with Microsoft Internet Information Services (IIS) security and includes authentication and authorization services to implement the ASP.NET security model. ASP.NET also includes a role-based security feature that you can implement for both Microsoft Windows and non-Windows user accounts.

This article is divided into the following sections:
Back to the top

Flow of Security with a Request

The following steps outline the sequence of events when a client makes a request:
  1. A client requests an .aspx page that resides on an IIS server.
  2. The client's credentials are passed to IIS.
  3. IIS authenticates the client and forwards the authenticated token along with the client's request to the ASP.NET worker process.
  4. Based on the authenticated token from IIS and the configuration settings for the Web application, ASP.NET decides whether to impersonate a user on the thread that is processing the request. In a distinct difference between Microsoft Active Server Pages (ASP) and ASP.NET, ASP.NET no longer impersonates the authenticated user by default. To enable impersonation, you must set the impersonate attribute of the identity section in the Web.config file to true.
For more information about the security flow, refer to the following topic in the .NET Framework Software Development Kit (SDK) documentation:
ASP.NET Data Flow
http://msdn.microsoft.com/en-us/library/xa68twcb(vs.71).aspx (http://msdn.microsoft.com/en-us/library/xa68twcb(vs.71).aspx)
For additional information about impersonating in ASP.NET, click the article number below to view the article in the Microsoft Knowledge Base:
306158  (http://support.microsoft.com/kb/306158/EN-US/ ) INFO: Implementing Impersonation in an ASP.NET Application
Back to the top

Related Configuration Settings

IIS maintains security-related configuration settings in the IIS metabase. However, ASP.NET maintains security (and other) configuration settings in Extensible Markup Language (XML) configuration files. Although this generally simplifies the deployment of your application from a security standpoint, the security model that your application adopts necessitates the correct configuration of both the IIS metabase and your ASP.NET application through its configuration file (Web.config).

The following configuration sections are related to ASP.NET security:
Back to the top

Authentication

Authentication is the process by which you obtain identification credentials such as the user's name and password and validate those credentials against some authority.

ASP.NET provides four authentication providers:

Forms Authentication

Forms authentication refers to a system in which unauthenticated requests are redirected to a Hypertext Markup Language (HTML) form in which users type their credentials. After the user provides credentials and submits the form, the application authenticates the request, and the system issues an authorization ticket in the form of a cookie. This cookie contains the credentials or a key to reacquire the identity. Subsequent requests from the browser automatically include the cookie.

For more information about Forms authentication, refer to the following topic in the .NET Framework SDK documentation:
The Forms Authentication Provider
http://msdn.microsoft.com/en-us/library/907hb5w9(vs.71).aspx (http://msdn.microsoft.com/en-us/library/907hb5w9(vs.71).aspx)
For additional information Forms authentication in ASP.NET, click the article number below to view the article in the Microsoft Knowledge Base:
301240  (http://support.microsoft.com/kb/301240/EN-US/ ) HOW TO: Implement Forms-Based Authentication in Your ASP.NET Application by Using C# .NET

Windows Authentication

In Windows authentication, IIS performs the authentication, and the authenticated token is forwarded to the ASP.NET worker process. The advantage of using Windows authentication is that it requires minimal coding. You may want to use Windows authentication to impersonate the Windows user account that IIS authenticates before you hand off the request to ASP.NET.

For more information about Windows authentication, refer to the following topic in the .NET Framework SDK documentation:
The WindowsAuthenticationModule Provider
http://msdn.microsoft.com/en-us/library/907hb5w9(vs.71).aspx (http://msdn.microsoft.com/en-us/library/907hb5w9(vs.71).aspx)

Passport Authentication

Passport authentication is a centralized authentication service, which Microsoft provides, that offers a single log on and core profile services for member sites. Typically, Passport authentication is used when you need single log on capability across multiple domains.

For more information about Passport authentication, refer to the following topic in the .NET Framework SDK documentation:
The Passport Authentication Provider
http://msdn.microsoft.com/en-us/library/f8e50t0f(vs.71).aspx (http://msdn.microsoft.com/en-us/library/f8e50t0f(vs.71).aspx)

Default Authentication

Default authentication is used when you do not want any security on your Web application; anonymous access is required for this security provider. Among all authentication providers, Default authentication provides maximum performance for your application. This authentication provider is also used when you use your own custom security module.

Back to the top

Authorization

Authorization is the process that verifies if the authenticated user has access to the requested resources.

ASP.NET offers the following authorization providers:

FileAuthorization

The FileAuthorizationModule class performs file authorization and is active when you use Windows authentication. FileAuthorizationModule is responsible for performing checks on Windows Access Control Lists (ACLs) to determine whether a user should have access.

UrlAuthorization

The UrlAuthorizationModule class performs Uniform Resource Locator (URL) authorization, which controls authorization based on the URI namespace. URI namespaces can be quite different from the physical folder and file paths that NTFS permissions use.

UrlAuthorizationModule implements both positive and negative authorization assertions; that is, you can use the module to selectively allow or deny access to arbitrary parts of the URI namespace for users, roles (such as manager, testers, and administrators), and verbs (such as GET and POST).

For more information about authorization in ASP.NET, refer to the following topic in the .NET Framework SDK documentation:
ASP.NET Authorization
http://msdn.microsoft.com/en-us/library/wce3kxhd(vs.71).aspx (http://msdn.microsoft.com/en-us/library/wce3kxhd(vs.71).aspx)
Back to the top

Role-Based Security

Role-based security in ASP.NET is similar to the role-based security that Microsoft COM+ and Microsoft Transaction Server (MTS) use, although there are important differences. Role-based security in ASP.NET is not limited to Windows accounts and groups. For example, if Windows authentication and impersonation is enabled, the identity of the user is a Windows identity (User.Identity.Name = "Domain\username"). You can check identities for membership in specific roles and restrict access accordingly. For example:

Visual Basic .NET Code
If User.IsInRole("BUILTIN\Administrators") Then
   Response.Write("You are an Admin")
Else If User.IsInRole("BUILTIN\Users") then
   Response.Write("You are a User")
Else
   Response.Write("Invalid user")
End if
Visual C# .NET Code
if ( User.IsInRole("BUILTIN\\Administrators"))
   Response.Write("You are an Admin");
else if (User.IsInRole("BUILTIN\\Users"))
   Response.Write("You are a User");
else
   Response.Write("Invalid user");
If you are using Forms authentication, roles are not assigned to the authenticated user; you must do this programmatically. To assign roles to the authenticated user, use the OnAuthenticate event of the authentication module (which is the Forms authentication module in this example) to create a new GenericPrincipal object and assign it to the User property of the HttpContext. The following code illustrates this:

Visual Basic .NET Code
Public Sub Application_AuthenticateRequest(s As Object, e As EventArgs)
   If (Not(HttpContext.Current.User Is Nothing)) Then
      If HttpContext.Current.User.Identity.AuthenticationType = "Forms" Then
         Dim id as System.Web.Security.FormsIdentity = HttpContext.Current.User.Identity
         Dim myRoles(3) As String
         myRoles(0)= "managers"
         myRoles(1)= "testers"
         myRoles(2)= "developers"
         HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(id,myRoles) 
      End If
   End If
End Sub
Visual C# .NET Code
public void Application_AuthenticateRequest(Object s, EventArgs e)      
{
   if (HttpContext.Current.User != null)
   {
      if (HttpContext.Current.User.Identity.AuthenticationType == "Forms" ) 
      {
         System.Web.Security.FormsIdentity id = HttpContext.Current.User.Identity;
         String[] myRoles = new String[3];
         myRoles[0]= "managers";
         myRoles[1]= "testers";
         myRoles[2]= "developers";
         HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(id,myRoles);
      }
   }
}
To check if the user is in a specific role and restrict access accordingly, use the following code (or similar) in your .aspx pages:

Visual Basic .NET Code
If User.IsInRole("managers") Then
   Response.Write("You are a Manager")
Else If  User.IsInRole("testers") Then
   Response.Write("You are a Tester")
Else If User.IsInRole("developers") Then
   Response.Write("You are a Developer")
End if
Visual C# .NET Code
if (User.IsInRole("managers"))
   Response.Write("You are a Manager");
else if (User.IsInRole("testers"))
   Response.Write("You are a Tester");
else if (User.IsInRole("developers"))
   Response.Write("You are a Developer");
For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
306238  (http://support.microsoft.com/kb/306238/EN-US/ ) HOW TO: Implement Role-Based Security with Forms-Based Authentication in Your ASP.NET Application by Using Visual Basic .NET
For more information on role-based security, refer to the following topic in the .NET Framework SDK documentation:
Role-Based Security
http://msdn.microsoft.com/en-us/library/52kd59t0(vs.71).aspx (http://msdn.microsoft.com/en-us/library/52kd59t0(vs.71).aspx)
Back to the top

REFERENCES

For information on ASP.NET security guidelines, see the following MSDN white paper:
Authentication in ASP.NET: .NET Security Guidance
http://msdn.microsoft.com/en-us/library/ms978378.aspx (http://msdn.microsoft.com/en-us/library/ms978378.aspx)
For more general information about ASP.NET, refer to the following MSDN newsgroup:
microsoft.public.dotnet.framework.aspnet (http://msdn.microsoft.com/newsgroups/default.aspx?query=microsoft.public.dotnet.framework.aspnet&dg=&cat=en-us-msdn&lang=en&cr=US&pt=&catlist=774F24A2-F71F-425F-AC2B-DC48AB0DA5C9&dglist=&ptlist=&exp=&sloc=en-us)
For additional information, click the article numbers below to view the articles in the Microsoft Knowledge Base:
311094  (http://support.microsoft.com/kb/311094/EN-US/ ) BUG: "ConfigurationException" Error Message When Impersonated Accounts Read Configuration
306359  (http://support.microsoft.com/kb/306359/EN-US/ ) PRB: Request.ServerVariables("LOGON_USER") Returns Empty String in ASP.NET
313091  (http://support.microsoft.com/kb/313091/EN-US/ ) HOW TO: Create Keys by Using Visual Basic .NET for Use in Forms Authentication
313116  (http://support.microsoft.com/kb/313116/EN-US/ ) PRB: Forms Authentication Requests Are Not Directed to loginUrl Page
For more information, see the following books:
Reilly, Douglas J. Designing Microsoft ASP.NET Applications (http://www.microsoft.com/mspress/books/toc/5136.aspx) . Microsoft Press, 2001.

Esposito, Dino.Building Web Solutions with ASP.NET and ADO.NET (http://www.microsoft.com/learning/en/us/Books/5727.aspx) . Microsoft Press, 2001.
Back to the top
APPLIES TO
  • Microsoft ASP.NET 1.0
  • Microsoft ASP.NET 1.1
Back to the top
Keywords: 
kbproductlink kbarttyperoadmap kbconfig kbinfo kbsecurity kbweb KB306590
Back to the top