ASP. NET security question-ASP. NET security architecture

 

ASP. NET Security Architecture

The previous article discussed many theoretical things, so I decided to skip some theoretical explanations and look at ASP first. NET Security Architecture. I will talk about the theoretical knowledge in the next article, so that it may be better. In addition, this article focuses on the interpretation of many common concepts. I believe you will have some gains after reading them.
 

In developing Web programs, we can choose to use our own methods to implement security policies, or purchase third-party security code and products. In any case, it is very costly, fortunately. NET Framework has built-in security solutions. ASP. NET and. NET Framework work with IIS to provide a basic structure for Web Application Security. One of its obvious advantages is that we don't have to write our own security architecture, and we can use it. NET Security Architecture built-in features, and the entire security architecture is tested and tested by time.

. NET security architecture includes many classes, which are used to process identity authentication, authorization, role-based authorization, counterfeit (Impersonation), and secure code access, it also contains a basic architecture for building a custom solution.
 
This article focuses on the following topics:
Main functions of ASP. NET Security Architecture
Authentication and authorization
Identity and subject in security context
Run the Authentication Module
Authorization module operation

Start:
The ASP. NET security architecture consists of several key security processes: identity authentication, authorization, counterfeiting, and encryption provide the necessary functions. Let's take a look at some explanations:
-- Specifies who visits our site again
---- Who can operate and access resources? Is the user accessing the website authorized to use the requested resources?
---- What role are you going to impersonate? (Note: counterfeiting is not a derogatory term. It is not often said that counterfeit goods are counterfeited because different user roles have different permissions. If our current users cannot access a specific resource, we can impersonate users who want to access specific resources. Specifically, we can simulate users who have access to specific resources. In short, user A wants to access resources C, but has no permission, but user B can access, so A and B discuss, A will access with B's identity. (For more information)

Next, let's take a look at each security process:

Identity Authentication refers to the process of revealing the user identity (note: the concept of identity is what we will talk about right away, in short, the user ID and name) and determining the authenticity of the identity. Well understood. For example (note some terms in this example): We want to attend a meeting, we will obtain some of our creden。 (indicating our identity) provided by the registration. Once the identity is confirmed, we will get the meeting pass and we will be able to bring the pass to the meeting. In addition, everyone in the meeting can learn some information about us through our pass, such as our name and company. Identity Authentication is: Once the identity is identified, we will get a person that can recognize us, so no matter where we are in a specific region, all of our identifiers can be identified.

In ASP. NET, there are 4 authentication modes:

For each authentication method, you must provide creden during logon. Once the identity is verified, the user will receive an authentication token. In Forms authentication, the entire token is FormsAuthenticationTicket, and the entire token is placed in the cookie. Each time a resource is requested, the token will provide the user's identification information.

2. Authorization
Let's look at the example of the previous Meeting. authorization is to show what we can do. After entering the conference hall, we found that there were many different conferences, expert-level, General-level, and different people attended different levels of meetings. In addition, some people can visit the whole conference hall, but some people can only visit the exhibition hall. This is caused by different permissions.

Therefore, authorization is to approve or deny access to the requested resources based on our identification information. Note that role-based authorization is commonly used to divide users into groups and then assign different roles to each group.
 

Counterfeit code is executed in the context of other user IDs. By default, all ASP. NET code is executed under the Domain/ASPNET user account. We should use other identifiers to execute code and counterfeit other identifiers. NET security architecture. It allows us to specify the user account for code execution, such as a user account different from Domain/ASPNET. You can use the authentication feature in ASP. NET to authenticate users, or use standard Windows authentication to authenticate users.

Then we can use our creden。 or pre-defined user accounts that execute code to set fake accounts.
 
Counterfeiting also allows us not to use ASP. NET provides identity authentication and authorization: We can use user accounts and their related permissions to support authentication and authorization for Windows and IIS management.

Counterfeiting is usually used to provide access control, such as authorization. An application can access any resources that its spoofed users can access. For example, by default, Domain/ASPNET users cannot perform read/write operations on the file system, so this user account cannot execute transactions in Enterprise Services. However, with counterfeiting, users can do this by impersonating a specific Windows account, because this account has this permission. Therefore, we can ensure that some users can perform read and write operations on the file system, while others only perform read operations.

When users access the Web site for the first time, they are anonymous users and we do not know their identity. Unless they are authenticated, we still do not know their identity in the future. When a user requests a non-secure resource, they can automatically access the resource (this is the definition of a non-secure resource)

When a user requests secure protected resources, perform the following steps:
1. The request is sent to the Web server. Because the user ID is still confirmed, the user is redirected to the logon page.
2. If you provide creden2, The creden will be verified and reviewed upon authentication.
3. If the user credential is valid, you can access the resource. Otherwise, you cannot.

When a user requests a secure resource, but the resource can only be accessed by users with specific permissions, the following steps are taken:
1. The request is sent to the Web server. Because the user ID is still confirmed, the user is redirected to the logon page.
2. If you provide creden2, The creden will be verified and reviewed upon authentication.
3. Compare the credential or role of the user with the authorized user or role. If the user is in the list, the user is allowed to access the resource. Otherwise, the user is rejected.
 
 
 
If counterfeit is enabled, both of the two cases will happen. By default, counterfeiting is forbidden. You can modify the configuration file to add the <identity> element to enable it:
<Configuration>
<System. web>
<Identity impersonate = "true" userName = "Xiaoyang/User" password = "xiaoyang"/>
</System. web>
</Configuration>
 

In <identity>, set impersonate to true, and set userName and password to the user account to be counterfeited. If the counterfeit feature is enabled, the authenticated credential is the credential of the counterfeit user identity, rather than the submitted credential. These two creden may be the same. Note that the counterfeit credential is accessed by an existing user on the Web server, such as an IUser.
 
Source: http://yanyangtian.cnblogs.com/