Velocity Reviews

Velocity Reviews (http://www.velocityreviews.com/forums/index.php)
-   ASP .Net (http://www.velocityreviews.com/forums/f29-asp-net.html)
-   -   web application security (http://www.velocityreviews.com/forums/t99171-web-application-security.html)

Stephen 03-22-2005 08:06 PM

web application security
 
I have my intranet setup on our web server. It contains multiple
applications, but none are set up in the default application pools. In
other words, I create a webform and plop it into a directory on the web
server. My question revolves around security models for the
applications. I have been rethinking my current security strategy,
which is basically as follows:

dim strUser as string=ucase(User.Identity.Name)
dim boolAccess as boolean = false
if strUser = "DOMAIN\USERNAME1" or strUser = " DOMAIN \ USERNAME3" then
boolAccess=true
end if

if boolAccess = false then
response.write(strUser & "-You are not authorized to access this
area.")
response.end
end if

This validates the user on the page load event. The only problem with
this is now I have about 50+ web forms and managing this is getting to
be an issue, not to mention if someone new needs access to the webform,
someone (me) has to go into the code and add them. This isn't
(obviously) an ideal situation, as I would like to make it so the sys
admin can add/remove users/roles from a webform. Here is what I have
contrived in my puny head about my options:

1.Create (application) roles in AD, then use this code to restrict
access in each of the webforms that need it:

string strUser =User.Identity.Name.ToUpper();
bool boolAccess = false;
if (User.IsInRole("DOMAIN\\RoleName")) {
<Allow access>
}
else {
<Deny access>
}
return;

2. Set the permissions (AD role based) on the files in IIS (I think
this is called file authorization)

There are a couple others such as URL Author & .Net Roles of which I no
little about. Option 1 above has the problem of still requiring
manipulating code if roles need adding or removing, so I don't much
like this option except for very specific functions. Option 2 seems
like the best for controlling access to a entire webform from an
non-developer admin point. The other two options I need some educating
on.

Our intranet uses integrated windows authentication with anonymous
access turned off. I don't forsee ever needing to allow
non-authenticated users access to this site.

I have downloaded information on asp.net security, but there is a
mountain of information to wade through. I was hoping someone could
give me some pointers on implementing a simple security model and maybe
share some experiences they've had. Some of this is driven by
compliance with Sarbanes-Oxley.

Any help is appreciated.


ashish 03-22-2005 10:53 PM

Re: web application security
 
you can use forms authentication with active directory, then you wont
have to worry about anything

http://msdn.microsoft.com/library/de...l/secmod16.asp


hth
-ashish


Stephen wrote:
> I have my intranet setup on our web server. It contains multiple
> applications, but none are set up in the default application pools. In
> other words, I create a webform and plop it into a directory on the web
> server. My question revolves around security models for the
> applications. I have been rethinking my current security strategy,
> which is basically as follows:
>
> dim strUser as string=ucase(User.Identity.Name)
> dim boolAccess as boolean = false
> if strUser = "DOMAIN\USERNAME1" or strUser = " DOMAIN \ USERNAME3" then
> boolAccess=true
> end if
>
> if boolAccess = false then
> response.write(strUser & "-You are not authorized to access this
> area.")
> response.end
> end if
>
> This validates the user on the page load event. The only problem with
> this is now I have about 50+ web forms and managing this is getting to
> be an issue, not to mention if someone new needs access to the webform,
> someone (me) has to go into the code and add them. This isn't
> (obviously) an ideal situation, as I would like to make it so the sys
> admin can add/remove users/roles from a webform. Here is what I have
> contrived in my puny head about my options:
>
> 1.Create (application) roles in AD, then use this code to restrict
> access in each of the webforms that need it:
>
> string strUser =User.Identity.Name.ToUpper();
> bool boolAccess = false;
> if (User.IsInRole("DOMAIN\\RoleName")) {
> <Allow access>
> }
> else {
> <Deny access>
> }
> return;
>
> 2. Set the permissions (AD role based) on the files in IIS (I think
> this is called file authorization)
>
> There are a couple others such as URL Author & .Net Roles of which I no
> little about. Option 1 above has the problem of still requiring
> manipulating code if roles need adding or removing, so I don't much
> like this option except for very specific functions. Option 2 seems
> like the best for controlling access to a entire webform from an
> non-developer admin point. The other two options I need some educating
> on.
>
> Our intranet uses integrated windows authentication with anonymous
> access turned off. I don't forsee ever needing to allow
> non-authenticated users access to this site.
>
> I have downloaded information on asp.net security, but there is a
> mountain of information to wade through. I was hoping someone could
> give me some pointers on implementing a simple security model and maybe
> share some experiences they've had. Some of this is driven by
> compliance with Sarbanes-Oxley.
>
> Any help is appreciated.
>


=?Utf-8?B?QWxpZW4yXzUx?= 03-22-2005 11:01 PM

RE: web application security
 
Stephen,

Because your existing intranet uses Windows Integrated security you are
already on the right track. ALWAYS resist the temptation to apply any kind of
security to a specific user, create a role and validate membership within the
role to secure the item. Typically I find myself doing a lot of role checking
in the presentation tier, for instance I have an application that everyone in
the organization uses but some users only get to read, others get to update
others get to audit and so on depending on role membership. When you start
authenticating users to the database using Integrated Security you'll run
into the limitations of NTLM and you'll have to use kerberos, ultimately this
is what your dba's will want because it shifts the user management piece to
the network administrators. I will post more later I have an urgent task that
just came up...




"Stephen" wrote:

> I have my intranet setup on our web server. It contains multiple
> applications, but none are set up in the default application pools. In
> other words, I create a webform and plop it into a directory on the web
> server. My question revolves around security models for the
> applications. I have been rethinking my current security strategy,
> which is basically as follows:
>
> dim strUser as string=ucase(User.Identity.Name)
> dim boolAccess as boolean = false
> if strUser = "DOMAIN\USERNAME1" or strUser = " DOMAIN \ USERNAME3" then
> boolAccess=true
> end if
>
> if boolAccess = false then
> response.write(strUser & "-You are not authorized to access this
> area.")
> response.end
> end if
>
> This validates the user on the page load event. The only problem with
> this is now I have about 50+ web forms and managing this is getting to
> be an issue, not to mention if someone new needs access to the webform,
> someone (me) has to go into the code and add them. This isn't
> (obviously) an ideal situation, as I would like to make it so the sys
> admin can add/remove users/roles from a webform. Here is what I have
> contrived in my puny head about my options:
>
> 1.Create (application) roles in AD, then use this code to restrict
> access in each of the webforms that need it:
>
> string strUser =User.Identity.Name.ToUpper();
> bool boolAccess = false;
> if (User.IsInRole("DOMAIN\\RoleName")) {
> <Allow access>
> }
> else {
> <Deny access>
> }
> return;
>
> 2. Set the permissions (AD role based) on the files in IIS (I think
> this is called file authorization)
>
> There are a couple others such as URL Author & .Net Roles of which I no
> little about. Option 1 above has the problem of still requiring
> manipulating code if roles need adding or removing, so I don't much
> like this option except for very specific functions. Option 2 seems
> like the best for controlling access to a entire webform from an
> non-developer admin point. The other two options I need some educating
> on.
>
> Our intranet uses integrated windows authentication with anonymous
> access turned off. I don't forsee ever needing to allow
> non-authenticated users access to this site.
>
> I have downloaded information on asp.net security, but there is a
> mountain of information to wade through. I was hoping someone could
> give me some pointers on implementing a simple security model and maybe
> share some experiences they've had. Some of this is driven by
> compliance with Sarbanes-Oxley.
>
> Any help is appreciated.
>
>


Stephen 03-23-2005 04:43 PM

Re: web application security
 
I happen to be the dba too. One on many jobs I have here :).

I agree with you. The only problem I can see is the number of
potential roles getting out of hand. After doing some reading I am
looking into a solution using web.config files and roles. I will check
back and see what else you have to say.

Alien2_51 wrote:
> Stephen,
>
> Because your existing intranet uses Windows Integrated security you

are
> already on the right track. ALWAYS resist the temptation to apply any

kind of
> security to a specific user, create a role and validate membership

within the
> role to secure the item. Typically I find myself doing a lot of role

checking
> in the presentation tier, for instance I have an application that

everyone in
> the organization uses but some users only get to read, others get to

update
> others get to audit and so on depending on role membership. When you

start
> authenticating users to the database using Integrated Security you'll

run
> into the limitations of NTLM and you'll have to use kerberos,

ultimately this
> is what your dba's will want because it shifts the user management

piece to
> the network administrators. I will post more later I have an urgent

task that
> just came up...
>
>
>
>
> "Stephen" wrote:
>
> > I have my intranet setup on our web server. It contains multiple
> > applications, but none are set up in the default application pools.

In
> > other words, I create a webform and plop it into a directory on the

web
> > server. My question revolves around security models for the
> > applications. I have been rethinking my current security strategy,
> > which is basically as follows:
> >
> > dim strUser as string=ucase(User.Identity.Name)
> > dim boolAccess as boolean = false
> > if strUser = "DOMAIN\USERNAME1" or strUser = " DOMAIN \ USERNAME3"

then
> > boolAccess=true
> > end if
> >
> > if boolAccess = false then
> > response.write(strUser & "-You are not authorized to access this
> > area.")
> > response.end
> > end if
> >
> > This validates the user on the page load event. The only problem

with
> > this is now I have about 50+ web forms and managing this is getting

to
> > be an issue, not to mention if someone new needs access to the

webform,
> > someone (me) has to go into the code and add them. This isn't
> > (obviously) an ideal situation, as I would like to make it so the

sys
> > admin can add/remove users/roles from a webform. Here is what I

have
> > contrived in my puny head about my options:
> >
> > 1.Create (application) roles in AD, then use this code to restrict
> > access in each of the webforms that need it:
> >
> > string strUser =User.Identity.Name.ToUpper();
> > bool boolAccess = false;
> > if (User.IsInRole("DOMAIN\\RoleName")) {
> > <Allow access>
> > }
> > else {
> > <Deny access>
> > }
> > return;
> >
> > 2. Set the permissions (AD role based) on the files in IIS (I think
> > this is called file authorization)
> >
> > There are a couple others such as URL Author & .Net Roles of which

I no
> > little about. Option 1 above has the problem of still requiring
> > manipulating code if roles need adding or removing, so I don't much
> > like this option except for very specific functions. Option 2

seems
> > like the best for controlling access to a entire webform from an
> > non-developer admin point. The other two options I need some

educating
> > on.
> >
> > Our intranet uses integrated windows authentication with anonymous
> > access turned off. I don't forsee ever needing to allow
> > non-authenticated users access to this site.
> >
> > I have downloaded information on asp.net security, but there is a
> > mountain of information to wade through. I was hoping someone

could
> > give me some pointers on implementing a simple security model and

maybe
> > share some experiences they've had. Some of this is driven by
> > compliance with Sarbanes-Oxley.
> >
> > Any help is appreciated.
> >
> >



=?Utf-8?B?QWxpZW4yXzUx?= 03-23-2005 05:59 PM

Re: web application security
 
Hi Stephen,

Just one thing I'd like to add, IIS is already authenticating clients
against AD, they have access by virtue of being logged into the domain and
the ACL permissions on the web server, there's no sense in having them
authenticate again using a forms authentication scenerio.

"Stephen" wrote:

> I happen to be the dba too. One on many jobs I have here :).
>
> I agree with you. The only problem I can see is the number of
> potential roles getting out of hand. After doing some reading I am
> looking into a solution using web.config files and roles. I will check
> back and see what else you have to say.
>
> Alien2_51 wrote:
> > Stephen,
> >
> > Because your existing intranet uses Windows Integrated security you

> are
> > already on the right track. ALWAYS resist the temptation to apply any

> kind of
> > security to a specific user, create a role and validate membership

> within the
> > role to secure the item. Typically I find myself doing a lot of role

> checking
> > in the presentation tier, for instance I have an application that

> everyone in
> > the organization uses but some users only get to read, others get to

> update
> > others get to audit and so on depending on role membership. When you

> start
> > authenticating users to the database using Integrated Security you'll

> run
> > into the limitations of NTLM and you'll have to use kerberos,

> ultimately this
> > is what your dba's will want because it shifts the user management

> piece to
> > the network administrators. I will post more later I have an urgent

> task that
> > just came up...
> >
> >
> >
> >
> > "Stephen" wrote:
> >
> > > I have my intranet setup on our web server. It contains multiple
> > > applications, but none are set up in the default application pools.

> In
> > > other words, I create a webform and plop it into a directory on the

> web
> > > server. My question revolves around security models for the
> > > applications. I have been rethinking my current security strategy,
> > > which is basically as follows:
> > >
> > > dim strUser as string=ucase(User.Identity.Name)
> > > dim boolAccess as boolean = false
> > > if strUser = "DOMAIN\USERNAME1" or strUser = " DOMAIN \ USERNAME3"

> then
> > > boolAccess=true
> > > end if
> > >
> > > if boolAccess = false then
> > > response.write(strUser & "-You are not authorized to access this
> > > area.")
> > > response.end
> > > end if
> > >
> > > This validates the user on the page load event. The only problem

> with
> > > this is now I have about 50+ web forms and managing this is getting

> to
> > > be an issue, not to mention if someone new needs access to the

> webform,
> > > someone (me) has to go into the code and add them. This isn't
> > > (obviously) an ideal situation, as I would like to make it so the

> sys
> > > admin can add/remove users/roles from a webform. Here is what I

> have
> > > contrived in my puny head about my options:
> > >
> > > 1.Create (application) roles in AD, then use this code to restrict
> > > access in each of the webforms that need it:
> > >
> > > string strUser =User.Identity.Name.ToUpper();
> > > bool boolAccess = false;
> > > if (User.IsInRole("DOMAIN\\RoleName")) {
> > > <Allow access>
> > > }
> > > else {
> > > <Deny access>
> > > }
> > > return;
> > >
> > > 2. Set the permissions (AD role based) on the files in IIS (I think
> > > this is called file authorization)
> > >
> > > There are a couple others such as URL Author & .Net Roles of which

> I no
> > > little about. Option 1 above has the problem of still requiring
> > > manipulating code if roles need adding or removing, so I don't much
> > > like this option except for very specific functions. Option 2

> seems
> > > like the best for controlling access to a entire webform from an
> > > non-developer admin point. The other two options I need some

> educating
> > > on.
> > >
> > > Our intranet uses integrated windows authentication with anonymous
> > > access turned off. I don't forsee ever needing to allow
> > > non-authenticated users access to this site.
> > >
> > > I have downloaded information on asp.net security, but there is a
> > > mountain of information to wade through. I was hoping someone

> could
> > > give me some pointers on implementing a simple security model and

> maybe
> > > share some experiences they've had. Some of this is driven by
> > > compliance with Sarbanes-Oxley.
> > >
> > > Any help is appreciated.
> > >
> > >

>
>


Stephen 03-24-2005 03:04 PM

Re: web application security
 
I was under the impression that forms auth was meant primarily for
anomous access.

I didn't realize the breadth of security issues and methodologies
surrounding web applications. I downloaded a 600+ page document that
covered asp.net security alone.


Alien2_51 wrote:
> Hi Stephen,
>
> Just one thing I'd like to add, IIS is already authenticating clients


> against AD, they have access by virtue of being logged into the

domain and
> the ACL permissions on the web server, there's no sense in having

them
> authenticate again using a forms authentication scenerio.
>



Brock Allen 03-24-2005 06:07 PM

Re: web application security
 
> I was under the impression that forms auth was meant primarily for
> anomous access.


If you wanted anonymous access then you'd not use any authentication at all.
Forms is for authenticating users when you have your own username/password
store for such thing. Typically it's used when your users are not windows/domain
users.

-Brock
DevelopMentor
http://staff.develop.com/ballen





Stephen 03-25-2005 04:06 PM

Re: web application security
 
That makes sense, anonymous is anonymous. I thought it had something
to do with AD non-authenticated users.

Thanks.

Brock Allen wrote:
> > I was under the impression that forms auth was meant primarily for
> > anomous access.

>
> If you wanted anonymous access then you'd not use any authentication

at all.
> Forms is for authenticating users when you have your own

username/password
> store for such thing. Typically it's used when your users are not

windows/domain
> users.
>
> -Brock
> DevelopMentor
> http://staff.develop.com/ballen




All times are GMT. The time now is 10:01 AM.

Powered by vBulletin®. Copyright ©2000 - 2014, vBulletin Solutions, Inc.
SEO by vBSEO ©2010, Crawlability, Inc.