Anonymous Authentication and Security

[Kevin R.]

Hello All:

One of my controls in my ASP.NET application requires that IIS Anonymous
Access to be turned off. It also needs to have the following tag in
web.config:
<identity impersonate="true"/>
My question is does the above configuration pose a security risk that I
should be aware of, and if so how can I mitigate it.

Thx in advance,
kr

 

[Raterus]

Whoa..red flag, your control HAS to have Anonymous Access..? That sounds odd...very odd.. and rather ridiculous. As far as asp.net is concerned, it doesn't really care what authentication method was used by IIS, just that it worked.

Some will argue that you should never use <identity impersonate="true" />, rather impersonate from code found in the following link. http://support.microsoft.com/default.aspx?scid=kb;en-us;306158

It makes sense, most of the execution operations of your application don't need to run with impersonation, so there is no need to have the execution always impersonating. I think it confounds your code though, so I usually just use <identity impersonate="true" />, much easer to code. Up to you of course.

--Michael

 

[Kevin R.]

Michael,

Thanks for your reply. Yes, indeed I use the suggested code to isolate
impersonation to the page loading the control that requires
impersonation (I used the web.config example for clarity here). But, I
still do no fully understand the implications of having IIS anonymous
authentication turned off (disabled anonymous access in IIS). What is
the "red flag" you are referring to!

Can anyone explain it here or refer me to a good source.

Much appreciated,
kr

 

[Kevin R.]

Michael,

Thanks for your reply. Yes, indeed I use the suggested code to isolate
impersonation to the page loading the control that requires
impersonation (I used the web.config example for clarity here). But, I
still do no fully understand the implications of having IIS anonymous
authentication turned off (disabled anonymous access in IIS). What is
the "red flag" you are referring to!

Can anyone explain it here or refer me to a good source.

Much appreciated,
kr

 

[Raterus]

Sorry, I misread your original post, I thought you needed anonymous authentication turned on. If it is off, and you aren't impersonating, except through code, you should be very secure.