Web Application Authentication

Question

I have two questions concerning authentication of a intranet website and how to go about doing it.

I want the first page the user comes to, to be the login page. I could have sworn there was a tag, something like [Authorize] that you put in your C# code that did this for you but I can't find it anymore. Right now the first page is my dafault.aspx. I turned on windows authentication in the web.config file and it automatically logged me in. So that is working, but I want the user to have to login as stated above. What do I have to do?
I only want to allow people that are in a certain group to have access. How do I add this additional check?

Are the users based in Active Directory domain?

icelava
– icelava

2011-12-29 02:23:44 +00:00
Commented Dec 29, 2011 at 2:23 — icelava
– icelava, Commented Dec 29, 2011 at 2:23

joe_coolish · Accepted Answer · 2011-12-29 02:22:27Z

2

In your web.config file you need to add the following

<authentication mode="Forms">
  <forms loginUrl="YOUR LOGIN PAGE!!" timeout="2880" />
</authentication>

in the <system.web /> tag.

That will force the user to authenticate for that site.

The [Authorize] attribute is used to require a user be authenticated (like you had put in your question), BUT!! only for MVC applications http://msdn.microsoft.com/en-us/library/system.web.mvc.authorizeattribute.aspx

With MVC you can also do the [RequiresAuthentication(Roles = "admin")] attribute which will give you control over which rolls have access to which endpoints.

I would seriously consider MVC

answered Dec 29, 2011 at 2:22

joe_coolish

7,25913 gold badges68 silver badges114 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Craig Over a year ago

Yeah I thought about that but I am so far into this project now that I don't have the time to switch.

Daniel Szabo Over a year ago

@Craig: You'll find the time to make the switch when whatever hack you throw together comes crashing down. You're fortunate enough to know what the right solution to your problem is -- implement it.

joe_coolish Over a year ago

I took a position about a couple of years ago where I had to convert ~4 web systems from classic ASP to ASP.NET. I did all the work, everything was great. Then came MVC and I ended up converting 3 of the systems to MVC. I also decided to take all the Data layers and implement them in WCF. I left that job ~6 months ago. Everything is still working and the new dev has emailed me a few times telling me how grateful he is that I made the switch and how easy the code was to maintain. It's worth the time if you have it!

Bibhu · Accepted Answer · 2011-12-29 02:40:55Z

1

Use forms authentication instead of windows authentication. Have a look on these link they provide walk throughs for using forms authentication :

http://www.asp.net/web-forms/tutorials/security/introduction/an-overview-of-forms-authentication-vb

http://www.dotnetfunda.com/articles/article141.aspx

For using active directory go through these links :

http://msdn.microsoft.com/en-us/library/ms180890(v=vs.80).aspx

http://msdn.microsoft.com/en-us/library/ff650308.aspx

edited Dec 29, 2011 at 2:40

answered Dec 29, 2011 at 2:13

Bibhu

4,1014 gold badges35 silver badges64 bronze badges

5 Comments

Craig Over a year ago

You can use forms authentication with active directory?

Bibhu Over a year ago

@Craig - What do you mean by " active directory " ?

joe_coolish Over a year ago

No, you need to use Windows Authentication for Active Directory applications.

Gabriel GM Over a year ago

You can always validate the users against the Active Directory with the classes of the System.DirectoryServices namespace. This way you can make a custom authentication form and look give access according to the groups.

Bibhu Over a year ago

@Craig - No, you need to use Windows Authentication.

tedski · Accepted Answer · 2011-12-29 02:18:48Z

1

Here's a guide to setting up Forms Authentication on your site: https://web.archive.org/web/20211020150650/http://www.4guysfromrolla.com/webtech/110701-1.shtml

Part 2 has the meat of the stuff.

answered Dec 29, 2011 at 2:18

tedski

2,2863 gold badges27 silver badges48 bronze badges

Comments

Craig · Accepted Answer · 2011-12-30 01:56:07Z

0

Thanks for all the great input. They got me going in the right direction and then the customer decided to change direction. They want to have it auto login if they are in the right group, otherwise display and error message. The Form authentication would have worked as described.

answered Dec 30, 2011 at 1:56

Craig

1,2252 gold badges23 silver badges59 bronze badges

Collectives™ on Stack Overflow

Web Application Authentication

4 Answers 4

3 Comments

5 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

3 Comments

5 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related