IIS Authentication Knowledge Excerpt

IIS Authentication

ASP. NET authentication is divided into two steps. First, Internet Information Services (IIS) authenticates the user and creates a Windows token to represent the user. IIS determines which authentication mode should be used for a particular application by viewing the IIS metabase settings. If IIS is configured to use Anonymous authentication, a token is generated for the IUSR_MACHINE account and used to represent the anonymous user. IIS then passes the token to ASP.

Second, ASP. NET performs its own authentication. The authentication method used is specified by the Mode property of the authentication element. The following authentication configuration specifies that ASP. NET uses the FormsAuthenticationModule class:

<authentication mode= "Forms"/>

Note Because forms authentication is not dependent on IIS authentication, if you want to use Forms authentication in an ASP. NET application, you should configure anonymous access for your application in IIS.

Forms validation

ASP. NET Forms authentication occurs after IIS authentication is complete. You can use the forms element to configure forms authentication.

Create an authentication Cookie

Create an authentication Cookie from the FormsAuthentication class, as shown below. After the user has been authenticated, the FormsAuthentication class creates an FormsAuthenticationTicket object internally by specifying the cookie name, cookie version, directory path, cookie issuance date, and cookie Expiration date, whether the Cookie should be retained, and user-defined data (optional).

FormsAuthenticationTicket ticket = new FormsAuthenticationTicket (1,
"UserName",
DateTime.Now,
DateTime.Now.AddMinutes (+),//value of Time out property
False,//Value of Ispersistent property
String.Empty,
Formsauthentication.formscookiepath);

Next, if the protection property of the forms element is set to all or encryption, forms authentication uses the Encrypt method to encrypt and sign the Forms authentication ticket.

String encryptedticket = Formsauthentication.encrypt (ticket);

Reference

Http://www.cnblogs.com/winnerzone/archive/2007/06/29/800225.html

IIS Authentication Knowledge Excerpt