Authentication in .NET..... pointers

[Paul]

Background.

We have a corporate intranet that is (as much as makes no difference)
entirely IIS web servers & IE browsers. We use a standard Windows
domain logon and use active directory. We also have a "standard" user
(like a guest one) that has few privileges.

Web pages are secured and authenticated by manipulating the permissions
on the files and folders within the web. This has been the situation
for a number of years and is relatively set in stone. We use challenge
response to authenticate for web pages.

If a user logs on as the std user and tries to access a web page to
which they have no access, a login box appears. If they are really a
user with the correct credentials they can enter their userid/passwd at
the prompts. As I understand it, it isn't possible to revoke that
authentication (ie for that user to log off and revert to the std user)
without closing down IE and any other browser windows that the user may
have opened whilst "logged on." Is that correct?

Assuming that is correct, how would we manage the following. Imagine an
operation that needs two users to authorise it at the time it happens
(eg a second nurse witnessing the administration of a medicine in a
hospital, or a superviser check on a large transaction.) How could that
second person's credentials be checked against their windows domain
login and subsequently cancelled? Is there really no way to cancel the
1st user's logon either?

I'm fairly new to this so would appreciate some pointers.... i've
pondered with creating session variable "tokens" and all sorts of
things, but would like a nudge in the right direction before I get too
embroiled in all this as the inability to revoke the authentication
always seems to end up scuppering any idea that I have


Thanks

 

[Darrin J Olson]

I don't know that I could give you a complete solution, but I can give you
some ideas...

Putting your current authentication methods aside, ASP.NET has the ability
to make Principal objects and Identity objects (FormsIdentity for example)
where you can specify different directory and define application processing
permissions throughout your application and grant certain permissions to
certain users. You can also use the same objects to require a Union and/or
Intersection of permission sets for tasks and/or directories. The Union of
permissions may be helpful in requiring two different permission sets to be
required for access to a directory or to perform a certain task.

The trick would be if you need to tie these users to your current
authentication...

Hope that helps get you in the right direction...

-Darrin

 

[Paul]

I don't know that I could give you a complete solution, but I can give you
some ideas...

It's really ideas that I'm looking for....

Putting your current authentication methods aside,

I wish I could...

ASP.NET has the ability
to make Principal objects and Identity objects (FormsIdentity for example)
where you can specify different directory and define application processing
permissions throughout your application and grant certain permissions to
certain users. You can also use the same objects to require a Union and/or
Intersection of permission sets for tasks and/or directories. The Union of
permissions may be helpful in requiring two different permission sets to be
required for access to a directory or to perform a certain task.

That sounds interesting.... off to investigate later.....

The trick would be if you need to tie these users to your current
authentication...

Hmmmm..... This is where we've always fallen down. What we don't really
want is for users to have to maintain two separate userid/passwds (some
are bad enough at remembering the one passwd that they've got!!)

Thanks for the pointers.

 

[Darrin J Olson]

What I've done for applications such as this is create and manage my own
users, tasks, and roles. I could then assign multiple tasks to a role, and
assign multiple roles to a user. When I create a Principal object, I load
all of the roles for whatever user they signed in as to that Principal
object. Would it be possible to load the names of different Windows User
groups that an authenticated user is part of, and then use those groups as
the different roles to assign to your Principal object??? That way one user
could have a variable number of roles/groups, and you could base permissions
for different tasks by these roles/groups. I beleive the roles are based
only by text in the Principal object.

-Darrin

 

[Paul]

Would it be possible to load the names of different Windows User groups
that an authenticated user is part of, and then use those groups as the
different roles to assign to your Principal object???

I found this,

http://support.microsoft.com/default.aspx?scid=kb;EN-US;326340

which uses Forms authentication via Active Directory. At 1st glance it
seems that it'll achieve what i want. Need to look into this a little
bit more as it (authentication) is all new to me. Does anyone know
offhand whether I could have a generic windows user logged on and use
the above to authenticate another user who could then log off, leaving
the browser still open? Also, you must be able to have different levels
of security on different pages in the same app.? Mustn't you? (See, I
said it was new to me! )