Authentication as signature

[yzarcman]

I am working on an intranet and have a web app that I need to use
authentication for signing a document.

As an organization we have decided that a username and date/time stamp
would be sufficient to be considered a signature.

On some pages data is submitted and I'm just concerned about capturing
the username. On other pages I'm very concerned that the person
submitting data is really the person who is logged into the machine
(2003 server Active Directory). When they submit data on these pages I
would like to reprompt for password. To get to these pages it would be
nice if I could not prompt for the password and use NTSF permissions to
allow them access without prompting for password.

Any ideas on how to do this would be GREATLY appreciated.

Thanks,
Greg

 

[Scott Allen]

Hi Greg:

You can have your asp.net application use Windows authentication and
impersonate the client's identity. Impersonation would allow you to
use NTFS permissions to perform authorization. Your web.config would
look something like:

....
<authentication mode="Windows" />
<authorization>
<deny users="?"/> <!-- no anonymous users -->
<allow users="*">
</authorization>
<identity impersonate="true" />
....

Some more details are available here:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetch03.asp

 

[yzarcman]

I reviewed the posted document. Thanks for the link.

The other item I asked about was how to prompt for password in
sensitive pages.

I don't care if any authorized user enters data on the page, but based
on the data entered, I would like to ask them to enter their password
to authenticate the data before posting to the DB.

Thanks,
Greg

 

[Scott Allen]

You could use some code from the following chapter to validate a
username/password against active directory:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secmod/html/secmod16.asp

All you'll need then is to design a form to allow the user to type in
a password.