Intranet Security & Authentication

[CJM]

We have a simple intranet currently but as time goes by it is increasing in
its complexity and its use.

Some of the published content is only for the eyes of the select few.
Currently this is restricted by a DB-driven menu system; all users can view
standard content, but some users can login to view extra content. In
reality, only the intranet menus are restricted - if a user knew the path of
a restricted file, they could enter it into the address bar and access the
file. A bigger problem is searching. I've built a limited-scope search
facility using the indexing service, but if this was rolled out to the full
site, there would be no way for this facility to discriminate between 'open'
files and restricted files.

We are looking to improve the intranet soon, but the biggest problem I have
is which security model to choose. One of the ways we could probably
overcome the shortfalls of the current situation is to move to Integrated
Authentication. No login would be required, and AFAIK, the indexing service
would only return files that the user is entitled to view(?). The problem
with this scenario is with shared machines. For example, we are a group of
manufacturing companies, and we have shared machines on the shopfloors - in
most cases, the shop-floor staff have very limited access rights, but their
chargehands and team leaders need greater priveleges. The way it tends to
work is that one person logs onto the machine and all his colleagues share
his machines (and use his account!). I've been assured that this habit is
impossible to change!

Under an integrated auth scenario, the team leaders would either have to
share their privileges with their staff (very undesireable), or would have
to loose their privileges (also undesireable). In the current system, they
can log in and out of the intranet application as they wish.

What would be ideal is a combination of the two models: to have a login (and
logout) procedure that requires their Windows UID/Pwd. They could log in and
out when restricted files were needed, and in addition, the indexing service
search would be secured, and files would not be accessible directly via the
address bar.

I know the direct-access-through-address-bar problem can be solved by using
an ISAPI extension/filter. I've also heard something about ADAM (Active
Directory Application Mode), but I know very little about Integrated
Authentication, Active Directory, or ADAM. [You could say I dont know ADAM
from Adam... this probably is a very parochial joke]

I'm praying that there is somebody out there who has been in the same boat,
but failing that, ideas/suggestions/sympathy is welcomed from the floor.

Thanks

Chris

 

[[MSFT]]

Hi Chris,

If the windows integrated authentication is not suitable, you may consider
some customized authentication. For example, the database, create an
account table, including all accounts with powerfull permission. In your
ASP, you may use a session variant to indicate if a powerful account is
authenticated. If not, redirect it to a logon page when he request a high
security page.

You also can consider migrating to ASP.NET, wich support different
authentication. For example, form authentication.

Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

 

[CJM]

Hi Chris,

If the windows integrated authentication is not suitable, you may consider
some customized authentication. For example, the database, create an
account table, including all accounts with powerfull permission. In your
ASP, you may use a session variant to indicate if a powerful account is
authenticated. If not, redirect it to a logon page when he request a high
security page.

I already have this design in place.

The problem is that much of the content available are PDFs/Office Documents
etc. If a user know where these documents are there is nothing stopping them
from entering the address of the document in the address bar.You try telling
an Excel spreadsheet to redirect to a login page! lol

You also can consider migrating to ASP.NET, wich support different
authentication. For example, form authentication.

Luke

ASP.NET is on my wish-list of things to learn, but it's not that
straightforward.

However, I should have a look and see if it can offer a better solution.

Thanks

 

[Roland Hall]

in message : : > Hi Chris,
: >
: > If the windows integrated authentication is not suitable, you may
consider
: > some customized authentication. For example, the database, create an
: > account table, including all accounts with powerfull permission. In your
: > ASP, you may use a session variant to indicate if a powerful account is
: > authenticated. If not, redirect it to a logon page when he request a
high
: > security page.
: >
:
: I already have this design in place.
:
: The problem is that much of the content available are PDFs/Office
Documents
: etc. If a user know where these documents are there is nothing stopping
them
: from entering the address of the document in the address bar.You try
telling
: an Excel spreadsheet to redirect to a login page! lol

Yes there is. Don't put the files under a virtual root and look at
TextStream.

http://www.pstruh.cz/tips/detpg_read-write-binary-files.htm

HTH...

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp

 

[Felix Wu [MSFT]]

Hi Chris,

Here is a Knowledge Base article that may help you implement what Roland's
suggested:

HOWTO: Read and Display Binary Data in ASP
http://support.microsoft.com/?id=193998

Also, if you are working in a domain environment, the Basic Authentication
can be another way to go. For the sake of protecting password, you'd better
use Basic Authentication together with SSL

Regards,

Felix Wu
=============
This posting is provided "AS IS" with no warranties, and confers no rights.


--------------------

 

[Roland Hall]

in message
: Here is a Knowledge Base article that may help you implement what Roland's
: suggested:
:
: HOWTO: Read and Display Binary Data in ASP
: http://support.microsoft.com/?id=193998
:
: Also, if you are working in a domain environment, the Basic Authentication
: can be another way to go. For the sake of protecting password, you'd
better
: use Basic Authentication together with SSL

Thanks Felix. This link may also be beneficial to the OP.

http://www.pstruh.cz/tips/detpg_read-write-binary-files.htm

HTH...

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp

 

[[MSFT]]

Thank for Roland's suggestion about binary read. It should be a proper
solution for this issue.

By the way, I think this is also a reason which supports a migration to
ASP.NET. Within ASP.NET HttpHandler, we also can handle the request to the
files like PDF or DOC.

Luke
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

 

[Felix Wu [MSFT]]

Sure

Thanks,

Felix Wu
=============
This posting is provided "AS IS" with no warranties, and confers no rights.


--------------------

From: "Roland Hall" <nobody@nowhere>
References: <[email protected]>

<$ixJ#[email protected]>
<[email protected]>

 

[Roland Hall]

in message
: Sure

Holy S**T Batman! I didn't realize I already posted that link. On the
upside, I don't drink alcohol so it could be worse, maybe...

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp