Page.User object
 

We are currently developing a corporate intranet app using ASP.Net 2.0 app
and wish to use Windows Integrated Security. I have developed a small test
app that excercises the capabilities of using Windows authentication and I
have two questions.

First, we have a requirement that our app be launched from a link on the
corporate intranet site which is implemented using JSP. Will the page.user
property still be populated with the credentials created and authenticated at
the time the user logged into the network when called from a JSP page??

Second, I have set up my test app with a default page and two other pages.
The two secondary pages are in their own directory and I have secured those
directories using the authorization tag in the web.config file (example below)

<authorization>
<deny users="?" />
<allow roles="XXX\YYYYYY" />
<deny users="*" />
</authorization>

When I try to access the secured page that I should not have access to, in
the development environment I am simply presented with the default "access is
denied" page. When I deploy the test app on IIS and access the secured page
that I do not have access to I am presented with the Windows logon screen to
supply a user id and password. If I supply a valid id and pw that does not
have access to the AD group 3 times I am then presented with the default
"access is denied" page. Is there a way to suppress the login page and go
directly to the "access is denied" page (trapping the failure and redirecting
to another page is also acceptable)?

Thanks in advance....

Re: Page.User object
 

Hi,

1) yes - that still works - it has nothing to do where the request comes
from - it has to enter the asp.net app which means IIS does authentication
and hands the information to asp.net

2) you can handle the End_Request event (e.g. in global.asax - if the status
code is 401 - do the redirect..)

---
Dominick Baier, DevelopMentor
http://www.leastprivilege.com

> We are currently developing a corporate intranet app using ASP.Net 2.0
> app and wish to use Windows Integrated Security. I have developed a
> small test app that excercises the capabilities of using Windows
> authentication and I have two questions.
>
> First, we have a requirement that our app be launched from a link on
> the corporate intranet site which is implemented using JSP. Will the
> page.user property still be populated with the credentials created and
> authenticated at the time the user logged into the network when called
> from a JSP page??
>
> Second, I have set up my test app with a default page and two other
> pages. The two secondary pages are in their own directory and I have
> secured those directories using the authorization tag in the
> web.config file (example below)
>
> <authorization>
> <deny users="?" />
> <allow roles="XXX\YYYYYY" />
> <deny users="*" />
> </authorization>
> When I try to access the secured page that I should not have access
> to, in the development environment I am simply presented with the
> default "access is denied" page. When I deploy the test app on IIS and
> access the secured page that I do not have access to I am presented
> with the Windows logon screen to supply a user id and password. If I
> supply a valid id and pw that does not have access to the AD group 3
> times I am then presented with the default "access is denied" page. Is
> there a way to suppress the login page and go directly to the "access
> is denied" page (trapping the failure and redirecting to another page
> is also acceptable)?
>
> Thanks in advance....
>

Re: Page.User object
 

Dominick,

Thanks for your response. I have one followup. If the JSP that is calling
our web app is being authenticated and served up via an Apache/Tomcat web
server will the .Net object structure (page.user) still be built up when the
ASP page gets initiated??

"Dominick Baier" wrote:

> Hi,
>
> 1) yes - that still works - it has nothing to do where the request comes
> from - it has to enter the asp.net app which means IIS does authentication
> and hands the information to asp.net
>
> 2) you can handle the End_Request event (e.g. in global.asax - if the status
> code is 401 - do the redirect..)
>
> ---
> Dominick Baier, DevelopMentor
> http://www.leastprivilege.com
>
> > We are currently developing a corporate intranet app using ASP.Net 2.0
> > app and wish to use Windows Integrated Security. I have developed a
> > small test app that excercises the capabilities of using Windows
> > authentication and I have two questions.
> >
> > First, we have a requirement that our app be launched from a link on
> > the corporate intranet site which is implemented using JSP. Will the
> > page.user property still be populated with the credentials created and
> > authenticated at the time the user logged into the network when called
> > from a JSP page??
> >
> > Second, I have set up my test app with a default page and two other
> > pages. The two secondary pages are in their own directory and I have
> > secured those directories using the authorization tag in the
> > web.config file (example below)
> >
> > <authorization>
> > <deny users="?" />
> > <allow roles="XXX\YYYYYY" />
> > <deny users="*" />
> > </authorization>
> > When I try to access the secured page that I should not have access
> > to, in the development environment I am simply presented with the
> > default "access is denied" page. When I deploy the test app on IIS and
> > access the secured page that I do not have access to I am presented
> > with the Windows logon screen to supply a user id and password. If I
> > supply a valid id and pw that does not have access to the AD group 3
> > times I am then presented with the default "access is denied" page. Is
> > there a way to suppress the login page and go directly to the "access
> > is denied" page (trapping the failure and redirecting to another page
> > is also acceptable)?
> >
> > Thanks in advance....
> >
>
>
>

Re: Page.User object
 

well- it has nothing to do where the request comes from - it has to do where
the request goes to...

in this case ASP.NET hosted in IIS - which does all the work for you - you
can also easily test that...

---
Dominick Baier, DevelopMentor
http://www.leastprivilege.com

> Dominick,
>
> Thanks for your response. I have one followup. If the JSP that is
> calling our web app is being authenticated and served up via an
> Apache/Tomcat web server will the .Net object structure (page.user)
> still be built up when the ASP page gets initiated??
>
> "Dominick Baier" wrote:
>
>> Hi,
>>
>> 1) yes - that still works - it has nothing to do where the request
>> comes from - it has to enter the asp.net app which means IIS does
>> authentication and hands the information to asp.net
>>
>> 2) you can handle the End_Request event (e.g. in global.asax - if the
>> status code is 401 - do the redirect..)
>>
>> ---
>> Dominick Baier, DevelopMentor
>> http://www.leastprivilege.com
>>> We are currently developing a corporate intranet app using ASP.Net
>>> 2.0 app and wish to use Windows Integrated Security. I have
>>> developed a small test app that excercises the capabilities of using
>>> Windows authentication and I have two questions.
>>>
>>> First, we have a requirement that our app be launched from a link on
>>> the corporate intranet site which is implemented using JSP. Will the
>>> page.user property still be populated with the credentials created
>>> and authenticated at the time the user logged into the network when
>>> called from a JSP page??
>>>
>>> Second, I have set up my test app with a default page and two other
>>> pages. The two secondary pages are in their own directory and I have
>>> secured those directories using the authorization tag in the
>>> web.config file (example below)
>>>
>>> <authorization>
>>> <deny users="?" />
>>> <allow roles="XXX\YYYYYY" />
>>> <deny users="*" />
>>> </authorization>
>>> When I try to access the secured page that I should not have access
>>> to, in the development environment I am simply presented with the
>>> default "access is denied" page. When I deploy the test app on IIS
>>> and
>>> access the secured page that I do not have access to I am presented
>>> with the Windows logon screen to supply a user id and password. If I
>>> supply a valid id and pw that does not have access to the AD group 3
>>> times I am then presented with the default "access is denied" page.
>>> Is
>>> there a way to suppress the login page and go directly to the
>>> "access
>>> is denied" page (trapping the failure and redirecting to another
>>> page
>>> is also acceptable)?
>>> Thanks in advance....
>>>