Migrating from ASP to ASP.NET - Security

(Page 10 of 11 )

Security is another area that requires a great deal of focus. Here is a brief overview of the ASP.NET security system. ASP.NET security is primarily driven from settings in the security sections of your web.config file. ASP.NET works in concert with IIS to provide a complete security model for your application. IIS security settings are some of the few application settings that will actually carry over and be applied to your ASP.NET application in a similar manner to that in ASP. There are, of course, many additional enhancements.

Authentication

For authentication, ASP.NET supports the different options shown in Table 2.

Table 2. ASP.NET Authentication Options

Type	Description
Windows	ASP.NET uses Windows authentication.
Forms	Cookie-based, custom login forms.
Passport	External Microsoft provided Passport Service.
None	No authentication is performed.

These are the same options you have in ASP, with the exception of the new Passport authentication option. As an example, the following configuration section enables Windows-based authentication for an application:


<configuration>
   <system.web>
      <authentication mode="Windows"/>
   </system.web>
</configuration>



Authorization

Once your users have been authenticated, you can focus on authorizing what resources you would like them to have access to. The following sample shows access being granted to "jkieley" and "jstegman," while everyone else is denied access.


<authorization>
   <allow users="NORTHAMERICAjkieley, REDMONDjstegman"/>
   <deny users="*"/>
</authorization>



Impersonation

As a refresher, impersonation refers to the process whereby an object executes code under the identity of the entity on whose behalf it is performing. In ASP, impersonation will allow your code to run on the behalf of an authenticated user. Alternately, your users can run anonymously under a special identity. By default, ASP.NET does not do per request impersonation. This is different from ASP. If you rely on this capability, you will need to enable this in your web.config file as follows:


<identity>
   <impersonation enable = "true"/>
</identity>



Next: Recomendation for Best Practices >>
 

More ASP.NET Articles
More By Dada Kalander

Comments On: Migrating from ASP to ASP.NET

>>> Be the FIRST to comment on this article!