I am going to setup a custom role provider, but I don't have a very good idea of how it works behind the scenes.
[Questions]
What is the difference between setting roles in a form authentication ticket and using a custom role provider? Which is better to use?
If I create a custom role provider can I user role names in the web.config to allow / block users?
Thx!
1- Not sure that there is a "better" choice, that has to do with the requirements of the project. I created a role provider based on Windows Authentication rather than Forms Authentication for an internal project because I didn't want to create a bunch of AD groups and I wanted Windows Auth to allow users into the site. As far as what does it do, it interacts with authenticated users to define who is allowed in what areas of the site.
2- Yes.
some additional info
Related
As the question states I would like to check what type of user is logged in by using data annotation
[Authorize(Roles="Admin")]
I have seen multiple questions and tutorial but none of them explain it clearly or use older mvc.
Is there a simple way to achieve that without using the stock authentication system provided with individual account authorization?
I simply do have a table for users with usernames passwords etc.
You have to deal with two things Authentication and Authorization.
Authentication
You can authenticate users using Owin forms Authentication or the old fashioned Forms Authentication if you prefer.
Authorization
For authorization you can create a custom Role Provider if you want to use Roles (as your did in your sample code) or you can use Claims Authorization.
This article is from 2013 but I successfully followed it to implement a custom role provider in my MVC5 application.
I need a good advise and wanted to know whether a solution is feasible or not. Right now one of my customer has a common login application which is based on Forms authentication(ASP.NET) using membership provider. All internal users use their AD credentials to logon and external users use custom username and password. Both are wrapped via Forms authentication. Now the new proposal is to replace this Forms authentication with ADFS. I have gone through various articles over internet and not able to come to a conclusion. Let me list my findings so far with ADFS extension points.
1) It is possible to add a custom attribute to ADFS claims by the approach mentioned in https://blogs.technet.microsoft.com/cloudpfe/2013/12/27/how-to-create-a-custom-attribute-store-for-active-directory-federation-services-3-0/.
2) It is possible to add a second level of authentication( or multifactor authentication) via the approach https://blogs.msdn.microsoft.com/jenfieldmsft/2014/03/24/build-your-own-external-authentication-provider-for-ad-fs-in-windows-server-2012-r2-walk-through-part-1/. Here I understand that after first level authentication done by AD then only our external provider will come into picture.
So I have a general question that is it really possible to achieve what I am looking for with ADFS. Please let me know.
This is based on where the user accounts are stored. If both internal and external users are in AD, you can just redirect to ADFS.
If internal is in AD and external is in an untrusted or other LDAP source, using ADFS 2016 you can link to both these account stores and still offload authentication to ADFS.
If external is in SQL, you can either use a virtual directory in front to project it as an LDAP store (previous option) or use IdentityServer.
If externs is something else, you'd need IdentityServer.
Thanks //Sam (#MrADFS)
Yes - you can add a custom attribute store.
Yes - you can add a custom authenticator.
A better way might be to use thinktecture's IdentityServer 3.0 for the ASP.NET Identity part and then federate IdentityServer and ADFS.
Scenario: An intranet ASP.Net application using Integrated Windows Authentication and a SqlRoleProvider for authorization. The application is used by a small subset of users within the domain.
If there are only a few users within the domain that should be able to access the application, can IWA be narrowed to allow authentication for that subset of users only, say via a domain group? Is this possible or even logical? This would certainly be the case if you predefined user accounts and used forms authentication. I understand that you can manage authorization within the application but wonder if the above is possible to add some security in depth. Appreciate your thoughts.
With anonymous access disabled, you can set the NTFS permissions on the web application directory to let only specific users in.
IWA will authenticate all valid users. But you can do the following,
allocate the subset of users into a group, and use role rrovider for them. Then you can allow only this group to use the application.
Or use forms authentication instead and write your own membership provider to authenticate users. Then you have all the controls and can block unwanted users.
You can also try some of the more traditional authorization techniques I outlined here:
Is it possible to restrict windows authenticated users in an ASPNet app to specific domains?
All our inhouse projects use Active Directory authentication and impersonation as this is the accepted security policy for the company.
I currently have a scenario where I need to store user profile information, and I would like to use the built-in Profile Providers which is standard in ASP.Net. I've previously used this happily with Forms Authentication, however I can't find any helpful information on how to implement this when using Windows Authentication.
Is there any way I can get just the Profile Provider working with Windows Authentication out of the box?
Will I be forced to create a custom profile provider?
The data will be stored in the database, not in Active Directory. However if the latter is possible some guidance would be appreciated.
Notes
I don't need to use the Role provider, this is handled by AD.
I am not sure if I need to implemented the AD Membership provider to get the Profile Provider to work.
you can just use the standard SqlProfileProvider. As username, use the Context.User.Identity.Name property. ASP.NET will create a user entry in it's standard tables himself to keep track of it. The role provider also works in combination with windows authentication. See this link for more information: http://weblogs.asp.net/scottgu/pages/Recipe_3A00_-Implementing-Role_2D00_Based-Security-with-ASP.NET-2.0-using-Windows-Authentication-and-SQL-Server.aspx
if you enable and configure the profile provider in the web.config, you can use it like this:
ProfileBase profile = ProfileBase.Create(Context.User.Identity.Name, true);
profile.SetPropertyValue("MyProfileProperty", propertyValue);
profile.Save();
Good luck!
I have a web application that currently only supports asp.net forms authentication.
My user business logic currently is like:
Users.GetUserByID(userID);
Users.LoginUser(username, password);
i.e. it is pretty modular and I hope supporting active directory won't be difficult.
Is it possible for me to support both AD and forms? If yes, what do I do, simply insert a new user for someone who signs into using AD for the first time?
No the only thing you have to do is witch you membership provider with the Active Directory membership provider. However there are some major differences, the user will always come in logged in with a specific user name, so there will be no need for a username and password.
The default provider for AD is "windows integrate authentication" and this cannot mix-and-match with forms auth. However if you decide to implement a custom provider, then you can maintain your business logic. You will have to write AD integration code. And yes, using the API for AD you can automatically add users, if you wish.