ASP.Net Security Framework by ygq15756


									ASP.Net Security Framework

        How .Net Security Works
• Users who log in to the application are granted a principal and an
  identity, based on the credentials they have provided.
• Principal object: Represents the group or role membership of the
  authenticated user, i.e. security context of the current user. It is
  possible to create a generic principal object using data from a
  database. Httpcontext.Current.User property returns an instance of
• Identity object represents the authenticated user. Windows
  authentication uses WindowsIdentity while forms authentication
  uses FormsIdentity object.
           IPrincipal Interface
• HttpContext.Current.User property returns an
  instance of IPrincipal
• It is part of System.Security.Principal
• Has a single property: Identity: Gets the IIdentity
  of the current Principal: Example:
• Has single method: IsInRole(roleName As
  String): Example: if
          IIdentity Interface
• Provides current user’s identity
• Four identity classes included in .Net:
  – System.Web.Security.WindowsIdentity
  – System.Web.Security.FormsIdentity
  – System.Web.Security.PassportIdentity
  – System.Web.Security.GenericIdentity
       Types of Authentication
•   Windows Authentication
•   Forms Authentication
•   Extending Forms Authentication
•   .Net Passport Authentication
•   Custom Authentication
     Windows Authentication
• Why this type?
    • Little work for programmer
    • Integrates well with IIS security
    • Integration with windows client machine---no need
      for a user to authenticate for an application if
      already done so initially by the windows OS
• Why not this type?
    • Tied to windows users
    • Tied to windows client M/C
    • Lack of flexibility
                    How does it work?
•   Internet Information Services (IIS) 6.0 is a powerful Web server that provides a highly
    reliable, manageable, and scalable Web application infrastructure for all versions of Windows
    Server 2003.
•   IIS uses three possible strategies to authenticate each request it receives:

          • Basic authentication: Username and password in
            clear text
          • Digest authentication: Username and password
            protected with digests
          • Integrated windows authentication: The identity of
            a user already logged in to Windows is passed
            automatically, without user entering it again
           Basic Authentication
• IIS obtains logon info from an HTTP client via the familiar
  windows dialog box to obtain username and password
• The information is then transmitted to the web server
• It then attempts to login to the windows account with the
  username and password
• It also checks if the account is allowed to access the
  requested file/directory
• If successful, the response rendered by web server is
  returned to the HTTP client
• Weakness: Username+password data between client
  and server is encodes into a string that intruders may
  have access to. So it is preferable to use if SSL-like
  secure mechanism is used in between.
        Digest Authentication
• Like basic authentication, it requires user
  to enter username/password.
• Instead of sending the password in clear, it
  sends a digest of the password.
     • The HTTP client creates a hash value of the
       password, the nonce sent by the HTTP server, and
       some other values. This hash is the digest
     • The HTTP server uses the stored password for the
       username to generate the hash (digest) and
       verifies it.
Integrated Windows Authentication
• Most popular among the simple authentication
• For users who have already logged into a
  Windows machine
• Provides WAN or LAN based internet
  applications with an authentication practice that
  is virtually invisible to the user
• A domain controller provides user credentials to
  the client station where user log in.
• These credentials are in turn transferred to the
  IIS at the request server
     Configuring ASP.Net to use
      Windows Authentication
• In web.config, set <authentication mode =
• This creates a WindowsPrincipal object
  and a WindowsIdentity object, with each
• User.Identity.Name provides user name
• WindowsPrincipal.IsInRole methods lets
  us test if the user has a specific role
       Forms Authentication
• Here, an HTML form is used for users to
  enter their credentials
• Similar to cookie authentication---where
  when a user’s credentials (username and
  password) are verified, a cookie is set.
  Subsequent requests use this cookie to
  identify the user.
Why Use Forms Authentication?
• Keeps all authentication code within the
• We have full control over the appearance
  of the login form
• Works for users with any browser
• Allows us to decide how to store user
  information (by default stored in
  web.config file but can be stored
Why not Forms authentication?
• We have to create our own interface for
  users to log in
• We have to maintain user details
• Resources protected by forms
  authentication must be processed by
  ASP.Net (i.e., anonymous access
  bypassing ASP.Net is not possible)
  How forms authentication works?
• When request is made to a page protected by forms authentication,
  the user is redirected to a login page. The URL of the original
  request is preserved.
• Login page contains a form for users to enter their credentials (e.g.,
  username and password)
• If the details the user entered are correct, an “Authentication ticket”
  is created. The ticket contains the encrypted details of the user. The
  ticket is written into a cookie and sent to the client machine.
• The user is then redirected back to the URL they originally
  requested. Now the authentication cookie is added to the request by
  the browser and picked up by the authentication module.
• The URL authorization module uses the details to verify user and
  provide access
      Forms Authentication API
• FormsAuthenticationModule class: To do the
  background work with the presented authentication ticket
  or cookie (done automatically); HTTP module that works
  in background
• FormsAuthentication class: Contains utility methods and
  properties that we can use when implementing forms
• FormsIdentity: An implementation of IIdentity
• FormsAuthenticationTicket class: Represents the details
  of a user that we will encrypt and write to the
  authentication cookie.
• These are all in System.Web.Security namespace
Implementing Forms Authentication
• Step 1: Configure forms authentication in the web.config file:
<authentication mode = “forms”>
<forms name=“xyzApplication” --- unique name for the cookie
  loginUrl=“secure/login.aspx” ---page to which user should be directed
timeout=“30”---length of time an authentication cookie is valid
Path=“/” ---path for the cookie for the browsers
Protection=“all” ---do both encryption and a MAC for the cookie
<credentials passwordFormat =“clear”>
     <user name =“xyz” password=“dqunik” />
     <username =“pqr” password = “ghwww” />
     Implementing Forms Authentication (Cont.)

• Step 2: Create a login form to enable users to enter their credentials
    – Login.aspx HTML page that handles the entering and validating the user
    – Login.aspx.cs class that has the business logic for the login.
private viod LoginButton_Click(0bject sender, System.EventArgs s)
{//Check credentials
If (FormsAuthentications.Authenticate
(UserNameTextBox.Text, passwordTextBox.Value))
(UserNameTextBox.Text, false);}---not a persistent cookie
{ErrorMessageLabel.Visible= true;}
• Later: More on other Authentication
   Implementing Authorization
• Granting access to resources using user names
  or roles
• Roles are similar to groups in Unix and Windows
• Application may define its own roles or use
  Windows roles
• In ASP.Net, the authorization starts from what
  ASPX pages the user is allowed to access
• ASP.Net provides some generic types of
  solutions: E.g., File Authorization, URL
  Authorization, and Custom Authorization
     How Identity and Principal are
• Types of identities (as we have already seen), depending on
  authentication used: WindowsIdentity, FormsIdentity,
  PassportIdentity, GenericIdentity
• All these implement IIdentity interface (part of
  System.Security.Principal namespace)
• An application may always find the user attached to the current
  thread using Identity object
• Principal: a combination of user and groups the user belongs to
• Principal types: WindowsPrincipal and GeneraicPrincipal
• Both implement IPrincipal interface (part of
  System.Security.Principal namespace)
• IPrincipal (as discussed before) provides the following:
       • IIdentity Identity (get): to get the underlying object
       • IsInRole(string role): to determine whether the user belongs to a certain role
            Role-based Security
• In general, authorization requirements are as follows:
   – Users should have proper credentials to access a resource
   – Certain users need to be denied access to particular resources
   – Only certain users should be allowed to access particular
• If you intend to use RBS, you must either assign an
  IPrincipal to a thread manually or configure the runtime
  to create one automatically
• Use System.AppDomain.SetThreadPrincipal to
  automatically generate for each thread, or
   – Set current thread’s IPrincipal manually using
     System.Thredaing.Thread.CurrentPrincipal property.
       Making Role-based Security
• Do not result in a stack walk---based solely on
  identity and roles of the active thread’s principal
• Imperative role-based security statements:
   – Commonly used constructor: PrincipalPermission
   – Each PrincipalPermission can specify only a single
     role name. “null” means to matching is needed
   – Public PrincipalPermission(string name, string role)
   PrincipalPermission p1 = new PrincipalPermission(“John”, “Manager”);

   PrincipalPermission p2 = new PrincipalPermission(null, “Programmer”);
   PrincipalPermission p3 = new PrincipalPermission(“Kevin”, null);
• Using Declarative role-based security
  – PrincipalPermissionAttribute may be applied to
    classes, methods, properties, or events to force
    declarative demands
  – This cannot be applied at the assemble level
  – Demand, LinkDemand, and InheritanceDemand are
    the only RBS statements allowed
   [PrincipalPermission(SecurityAction.Demand, Name=“John”, Role=“Manager”)]
   [PrincipalPermission(SecurityAction.Demand, Role=“Programmer”)]
   [PrincipalPermission(SecurityAction.Demand, Name=“Kevin”)]
                       File Authorization
•      FileAuthorizationModule class uses the underlying ACLs of the
       file system to control access to ASPX pages
•      This works only in conjunction with Windows Authentication
•      Example:
1.      Create a new web application. Name the form Index.aspx
2.      Place the following code under the <form> tag:
    <a href =“AuthorizedFile.aspx”> Click here for AuthorizedFile </a> <br>
          <a href =“UnAuthorizedFile.aspx”> Click here for UnAuthorizedFile </a>
3. Add two new web forms: AuthorizedFile.aspx and UnAuthorizedFile.aspx
4. Under <form> tag in AuthorizedFile type: <h2> You have access to the file </h2>
   Under <form> tag in UnAuthorziedFile type: <h2> You do not have access to the file </h2>
5. Build the solution and run: Clicking the links, the messages will appear
6. Create three different users: user1, user2, user3
7. Provide the following access rights to UnauthorizedFile.aspx: user1: Full access; user2: Read and
        Execute; user3: Deny All
8. Login as user3 and click on UnAuthorizedFile link; it will be denied access
         URL Authorization
Authorization section in web.config
<allow users=“john,jim,kevin”
  roles=“programmer,manager” verbs
<deny users=“?” />
? Anonymous users; * all users
• Authorization for a specific file or folder (using
<location path=“UnAuthorizedFile.aspx”>
     <deny users = “\localhost\user3” />
(This overrides what the OS says about the permissions)
      Calculation of Permissions
• The default permission is to allow access for all users
• Upon calculation of a merged rule set, the system checks the rules
   until it finds a match: either allow or deny
• When a deny is encountered, the system throws a 401 error:
   Unauthorized access
• Example:
At the application level, include in web.config: <authorization> <allow
   users=“localhost\user1, \localhost\user2” /> <deny users = “?”/>
At a particular page level, we can add this to web.config:
<location path=“UnAuthorizedFile.aspx”> <system.web>
   <authorization><deny roles = “users” /> </authorization>
</system.web> </location>
Denies access to this page to any windows user.
  Authorization Checks in Code
• We can control access even at a button level
  using checks in the code
• If {user1, user2} are made into a single group
  called validgroup, then:
{Response.Write (“You have access”);}
             Demanding Credentials
{ PrincipalPermission pp = new PrincipalPermission(“user1”, “validgroup”);
  Response.Write(“PrincipalPermission successful”);
Catch (SecurityException se)
{Response.Write (“PrincipalPermission Denied”);

Merging PrincipalPermission objects:
{PrincipalPermission pp1 = new PrincipalPermission(“user1”, “validgroup”);
{PrincipalPermission pp1 = new PrincipalPermission(“user2”, “validgroup”);
{PrincipalPermission pp3 = (PrincipalPermission)p1.Union (p2);
  Response.Write(“PrincipalPermission successful”);
Catch (SecurityException se)
{Response.Write (“PrincipalPermission Denied”);
       Another way to Authorize
• Place the following code above the
  method declaration:
[PrincipalPermissionAttribute(SecurityAction.Demand, Name=“user1”,
   Role = “validusers”)]

[PrincipalPermissionAttribute(SecurityAction.Demand, Role =
       Custom Authorization
• To be discussed later

To top