How does authorization work in asp.net ?, DOT NET Programming

Assignment Help:

The ASP.NET impersonation is totally controlled by entries in the applications web.config file. Default setting is "no impersonation". You can explicitly describe  that ASP.NET shouldn't use impersonation by including the following code in the file as shown:

It means that the ASP.NET will not perform any authentication and runs with its own priority . By default the ASP.NET runs as an unprivileged account named ASPNET. You can modify  this by making a setting in the processModel part of the machine.config file. Whenever you make this setting, it automatically applies to every site on the server. To the user a high-privileged system account instead of a low-privileged set the userName attribute of the processModel element to SYSTEM. Using this setting is a definite security risk,since  it elevates the privileges of the ASP.NET process to a point where it can do bad things to the operating system.

When you disable impersonation, all the request will run in the context of the account running the ASP.NET: either the ASPNET account or the system account. This is true when you are using anonymous access or authenticating users in few fashion. After the user has been authenticated, the ASP.NET uses its own identity to request access to resources.

The second possible setting is to turn on impersonation.

In this situation , the ASP.NET takes on the identity IIS passes to it. If you are allowing anonymous access in the IIS, this means that ASP.NET will impersonate the IUSR_ComputerName account that IIS itself uses. If you aren't allowing anonymous access,ASP.NET will take on  credentials of the authenticated user and made  requests for resources as if it were that user. Hence  by turning impersonation on and using a non-anonymous method of authentication in IIS, you can let users log on and use their identities within your ASP.NET application.

Finally, you can specify a particular identity to use for all authenticated requests

With this setting, all the requests are made as the specified user (Assuming that the password it correct in the configuration file). So, for e.g. you can designate a user for the single application, & use that user's identity every time someone authenticates to the application. The main drawback to this method is that you must embed the user's password

In the web.config file in the plain text. Although the ASP.NET won't allow anyone to download this file, this is still a security risk if anyone can get the file by some other means.


Related Discussions:- How does authorization work in asp.net ?

Give a brief introduction on side-by-side execution, Give a brief introduct...

Give a brief introduction on side-by-side execution. Can two applications, one using private assembly and the other using the shared assembly be stated as side-by-side executables?

Precautions for sqlserver mode, What are the precautions by which SQLSERVER...

What are the precautions by which SQLSERVER Mode work properly Following are the things to keep in mind so that the SQLSERVER Mode works properly:- A) In the SQLSERVER mode,

Which command-line tool generates code and mapping, Which command-line tool...

Which command-line tool generates code and mapping for the LINQ to SQL component of .NET Framework? The SqlMetal.exe command-line tool generates code and map the LINQ to SQL co

What is the relationship between a class and an object, What is the relatio...

What is the relationship between a class and an object? A class acts as a blue-print that explains the properties, states, and behaviors that are common to a number of objects.

Differentiate between the while and for loop in c#, Differentiate between t...

Differentiate between the while and for loop in C#. The while and for loops are used to implement those units of code that require to be repeatedly executed, unless the result

Nopcommerce expert needed, Readymade NopCom 3.2 receptive website needs mod...

Readymade NopCom 3.2 receptive website needs modifications. This is a developer/ webdesign (nopcommerce) opportunity which can allow a good developer/ designer the ability to creat

Print triangle in reverse pattern - c# program, Print Triangle in Reverse P...

Print Triangle in Reverse Pattern - C# Program Need the code of C# Program for Print Triangle in Reverse Pattern.

What is code access security, What is code access security (CAS)? Code ...

What is code access security (CAS)? Code access security (CAS) is part of the .NET security model that stops unauthorized access of resources and operations, and restricts the

Describe the eventlog class, Describe the EventLog class. The EventLog ...

Describe the EventLog class. The EventLog class is used to access the Windows event logs from Windows services. Using EventLog, you can also customize Windows event logs that r

Want c# single user login per session, Want C# Single User Login per sessio...

Want C# Single User Login per session Project Description: I need to save simulatenious logins for one account such as one user has a spottily premium account and someone tri

Write Your Message!

Captcha
Free Assignment Quote

Assured A++ Grade

Get guaranteed satisfaction & time on delivery in every assignment order you paid with us! We ensure premium quality solution document along with free turntin report!

All rights reserved! Copyrights ©2019-2020 ExpertsMind IT Educational Pvt Ltd