super user, power user, administrator or anonymous is defined by the application and given access to execute certain files, run certain functions or add/update/delete certain data.

Impersonation is when an application assumes the user’s identity as the request is passed to the application from IIS. Then, access is granted or denied based on the impersonated identity. So, we could establish two accounts in the application called genericUser and superUser, we could then selectively have incoming Web clients run as one of these accounts depending upon the rules established during authorization for each specific user.

Web.config and Security

There are two types of XML configuration files used by ASP.NET, they are called machine.config and Web.config. The format of these files and elements that they can contain are the same, however the machine.config file provides the default configuration for all applications and directories, while the Web.config file allows you to modify these defaults for a specific application or virtual directory. The machine.config is a located at:

[install drive]:\WINNT\Microsoft.NET\Framework\[ASP.NET Version Number]\CONFIG

and there is only one copy of this file per Webserver, whereas there may be dozens of Web.config files for various applications and subdirectories.

You can establish the conditions for access to a particular directory or application, by modifying the <system.Web> section in your application’s Web.config file. The conditions you set in the Web.config file will apply to the directory, which contains it, as well as all of its associated sub directories.

Within the Web.config file the <system.Web> section establishes the security profile for the application or directories overseen by it. The general syntax for the security section of the Web.config file is illustrated in Listing 13-1:

Listing 13-1 General syntax for the security section of the Web.config file

<?xml version=”1.0” encoding=”utf-8” ?> <configuration>

<location path=”[Path of specific file to which system.Web applies]”> <system.Web>

<authentication mode=”[Windows/Forms/Passport/None]”>

<forms name=”[name]” loginUrl=”[url]” protection=”[All, None, Encryption, Validation]” timeout=”[time in minutes]” path=”[path]” >

<credentials passwordFormat=”[Clear, SHA1, MD5]”> <user name=”[UserName]” password=”[password]”/>

</credentials>

</forms>

<Passport redirecturl=”internal” /> </authentication>

<authorization>

<allow users=”[comma separated list of users]” roles=”[comma separated list of roles]” verb=”[GET, POST, HEAD]”/>

<deny users=”[comma separated list of users]” roles=”[comma separated list of roles]” verb=”[GET, POST, HEAD]”/>

</authorization>

<identity impersonate=”[true/false]” name=”[Domain\Username to operate under]” password=”[password of Domain\UserName]”/>

</identity>

<system.Web>

</location>

</configuration>

The default and optional values for these elements are shown in Table 13-1.

Table 13-1 Default and Optional Values for Security Section of Web.config

Continued

The following example grants access to Tony, while denying it to Jason and anonymous users:

<?xml version=”1.0” encoding=”utf-8” ?> <configuration>

<system.Web>

<authorization>

<allow users=”Tony” /> <deny users=”Jason” /> <deny users=”?” />

</authorization>

<system.Web>

</configuration>

Next we’ll look at how users and roles may refer to multiple entities using a commaseparated list:

<allow users=”Tony, Jason, DomainName\tcaudill” />

As you can see, the domain account (DomainName\tcaudill) must include both the domain and user name combination.

Special identities

In addition to identity names, there are two special identities: *, which refers to all identities, and ?, which refers to the anonymous identity. So, to allow Jason and deny all other users you could set the configuration section as shown in the following code sample:

<?xml version=”1.0” encoding=”utf-8” ?> <configuration>

<system.Web>

<authorization>

<allow users=”Jason” />