I have some code code in App_Code that I want to expose via standard ASP pages/Forms authentication, as well as Web Services/Basic Authentication. Currently the folder layout is something like
MySite
MyPage.aspx
App_Code
-> Mycode.cs
Services
-> MyWebService.asmx
I understand that if I want Basic authentication for the web service, and forms for the normal pages, I need to convert the "Services" directory to an application in IIS. But once that's done how to I add a reference to the Web Service back to all the code in the root App_Code folder? (without it, I just get missing reference errors when connecting to the asmx page)
The only way that I've found to get this to work is to copy the App_Code & bin directories into the Services application. However, that causes problems for my app, and seems like a big hack to be honest.
I've decided to go a different route and write a single custom authentication module that combines Forms authentication and Basic authentication. That way I dont need to split the application, and I can have fine-grained control over which pages/directories I want to accept Basic, and which I want to accept Forms.
More info here: Combining Forms Authentication and Basic Authentication
Related
I have a database with usernames and passwords and I want to use it for authenticating ASP.net web page users.
I know how to do it with a webpage form (i.e. with just the simple form in HTML, C# provider and my web.config with authentication mode="Forms").
However I'd like to have a Popup Modal Dialog, see below (such as if I use authentication mode="Windows" or on Apache server .htaccess + .htpasswd).
How can I do that? Thanks.
You can try this tutorial which describes how to implement your own Basic Authentication HttpModule.
The example doesn't include the database integration, but it does indicate where you should do it, and takes care of most of the hard work.
Because it is an HttpModule you'll be able to reuse it easily in other project simply by referencing the library and linking it in your web.config.
I've got a WCF (RESTful) web service within an ASP.NET website project. The service resides at /WebServices/Registration.svc. I'm trying to create a custom BasicAuthenticationModule httpModule to handle Basic Auth as explained at https://stackoverflow.com/a/4729555/291323, but the module is being used for my entire website, which I do not want.
I tried using the tag to define the module for ONLY the service, but couldn't get it to work. I tried setting the path to both "WebServices/Registration.svc" as well as just "WebServices".
Is there a better way to register an httpModule to affect ONLY a WCF webservice within a website project?
TIA for any assistance!
I'm working with an ASP.NET application that is currently used only from intranet. The authentication mode for it is integrated Windows security. I now have a requirement that a part of the system should be visible externally with Forms based authentication.
Is it possible to set up authentication in web.config in a way that access to one of the pages goes through Forms while the other pages use integrated auth? Can it be done using a single web.config or do I need a subfolder with its own web.config file?
I know I could create a separate application for the external part but that would mean moving common parts around which ideally I'd like to avoid.
authentification-tag can be located only in Machine.config, Root-level Web.config, Application-level Web.config (source).
I suppose you should create new website in IIS for each authorization mode and add virtual directory that point to source code location. Every website should have custom web.config with authorization-settings.
You can set two MembershipProvider to authenticate users using FormsAuthentication.
For instance, if you want your application to authenticate intranet users with ActiveDirectory, you will select your first MembersipProvider and for the others the second one (you can manage it simply in your login page).
http://msdn.microsoft.com/en-us/library/system.web.security.activedirectorymembershipprovider.aspx
Or you can implement your own MembershipProvider:
http://msdn.microsoft.com/en-us/library/f1kyba5e.aspx
We have several asp.net MVC apps in the following setup
SecurityApp (root application - handles forms auth for SSO and has a profile edit page)
Application1 (virtual directory)
Application2 (virtual directory)
Application3 (virtual directory)
so that domain.com points to SecurityApp and domain.com/Application1 etc point to their associated virtual directories. All of our Single Sign On (SSO) is working properly using forms authentication.
Based on the users permissions when logging in a menu that lists their available applications and a logout link will be generated and saved in the cache - this menu displays fine whenever the user is in the SecurityApp (editing their profile) but we cannot figure out how to get the Applications in the virtual directories to display the same application menu.
We have tried:
1) Using JSONP to do an request that will return the html for the menu. The ajax call returns the HTML with the html; however, because User.IsAuthenticated is false the menu comes back empty.
2) We created a user control and include it along with the dll's for the SecurityApp project and this works; however, we dont want to have to include all the dlls for the SecurityApp project in every application that we create (along with all the app settings in the web.config)
We would like this to be as simple as possible to implement so that anyone creating a new app can add the menu to their application in as few steps as possible... Any ideas?
To Clarify - we are using ASP.NET MVC 1.0 since these apps are in production and we do not have the okay to go to ASP.NET MVC 2.0 (unfortunately)
Have you thought about using Single Project Areas?
Areas allows you to partition your application into discrete areas of functionality. It helps make managing a large application more manageable and allows for creating distinct applets that you can drop into an overall application.
There is a version of Areas that works in MVC 1.0 available here: http://haacked.com/archive/2008/11/04/areas-in-aspnetmvc.aspx
I have an application that uses Forms Authentication to authenticate one type of user. There is a section in this application that needs to be authenticated for another type of user using a different table in the database. The problem happens if the second type of user's session times out, she is taken to the login page defined in the Forms Authentication section of the main Web.Config instead of the login page for the second type of user. I am looking for solutions to this problem. One idea is to create an application in IIS for the section and create a Web.Config for the folder and add another Forms Authentication section. In my experiments, it seems this doesn't work. Am I missing something obvious? Any insights?
IIRC, the authentication works per folder. So you should be able to do it if all of the pages that require the 2nd type of authentication live in a specific sub-folder with it's own config.
Not 100% sure on this, though, so if someone more knowledgeable can contradict me I'll just delete the response.
You may need to double check me on the syntax, but the top level web.config can have any number of tags.
<location>...</location>
Inside you can specify separate config parameters for whatever folder/file you want. Look here for a reference.
EDIT: Apoligies, I neglected to format the code properly
You cannot have an <authentication> section inside of a <location> tag, so you must have the subfolder set up as an IIS (and ASP.NET) application of it's own. So, you should be able to run the subsection on it's own.
I think 500.19 is the "can't read or parse web.config" error - does it have details? You may need to turn on remote errors (or check Event Viewer) to see them. If you're still having issues, post a snippet of web.config.
As an aside - I've never been a fan of nested apps, and would probably prefer having your normal Login.aspx page handle it either with as a MemberOf or perhaps redirecting to a SpecialUserLogin.aspx or something. Nested apps are a PITA to setup and test, IME (for instance - I don't think you can even get it working under Cassini - though you can do 2 separate projects for it, and combine when you deploy).
Yes you can. The Web.config files have a tree-like inheriting arhitecture with override capabilities. Meaning you can modify the settings inside a sub-folder by placing a web.config file there and specifying different configuration settings.
The way I understand this problem, you have two solutions and the first is to look at Roles and the whole Provider Model would be a great place to start. Otherwise, the best bet would be to separate the application into two parts, breaking out the second user type area and then including it back into the main project via a Virtual Directory. Just remember that Virtual Directories inherit their permissions from the parent directories web.config, so you will need to use the <Location>tags to remove authentication for the virtual directory and then within the virtual directories web.config define your new forms authentication. This works well if you need Windows Authentication (NTLM) under Forms Authentication.