Page.User object

Discussion in 'ASP .Net Security' started by PaulB, Sep 29, 2006.

  1. PaulB

    PaulB Guest

    We are currently developing a corporate intranet app using ASP.Net 2.0 app
    and wish to use Windows Integrated Security. I have developed a small test
    app that excercises the capabilities of using Windows authentication and I
    have two questions.

    First, we have a requirement that our app be launched from a link on the
    corporate intranet site which is implemented using JSP. Will the page.user
    property still be populated with the credentials created and authenticated at
    the time the user logged into the network when called from a JSP page??

    Second, I have set up my test app with a default page and two other pages.
    The two secondary pages are in their own directory and I have secured those
    directories using the authorization tag in the web.config file (example below)

    <authorization>
    <deny users="?" />
    <allow roles="XXX\YYYYYY" />
    <deny users="*" />
    </authorization>

    When I try to access the secured page that I should not have access to, in
    the development environment I am simply presented with the default "access is
    denied" page. When I deploy the test app on IIS and access the secured page
    that I do not have access to I am presented with the Windows logon screen to
    supply a user id and password. If I supply a valid id and pw that does not
    have access to the AD group 3 times I am then presented with the default
    "access is denied" page. Is there a way to suppress the login page and go
    directly to the "access is denied" page (trapping the failure and redirecting
    to another page is also acceptable)?

    Thanks in advance....
     
    PaulB, Sep 29, 2006
    #1
    1. Advertising

  2. Hi,

    1) yes - that still works - it has nothing to do where the request comes
    from - it has to enter the asp.net app which means IIS does authentication
    and hands the information to asp.net

    2) you can handle the End_Request event (e.g. in global.asax - if the status
    code is 401 - do the redirect..)

    ---
    Dominick Baier, DevelopMentor
    http://www.leastprivilege.com

    > We are currently developing a corporate intranet app using ASP.Net 2.0
    > app and wish to use Windows Integrated Security. I have developed a
    > small test app that excercises the capabilities of using Windows
    > authentication and I have two questions.
    >
    > First, we have a requirement that our app be launched from a link on
    > the corporate intranet site which is implemented using JSP. Will the
    > page.user property still be populated with the credentials created and
    > authenticated at the time the user logged into the network when called
    > from a JSP page??
    >
    > Second, I have set up my test app with a default page and two other
    > pages. The two secondary pages are in their own directory and I have
    > secured those directories using the authorization tag in the
    > web.config file (example below)
    >
    > <authorization>
    > <deny users="?" />
    > <allow roles="XXX\YYYYYY" />
    > <deny users="*" />
    > </authorization>
    > When I try to access the secured page that I should not have access
    > to, in the development environment I am simply presented with the
    > default "access is denied" page. When I deploy the test app on IIS and
    > access the secured page that I do not have access to I am presented
    > with the Windows logon screen to supply a user id and password. If I
    > supply a valid id and pw that does not have access to the AD group 3
    > times I am then presented with the default "access is denied" page. Is
    > there a way to suppress the login page and go directly to the "access
    > is denied" page (trapping the failure and redirecting to another page
    > is also acceptable)?
    >
    > Thanks in advance....
    >
     
    Dominick Baier, Sep 30, 2006
    #2
    1. Advertising

  3. PaulB

    PaulB Guest

    Dominick,

    Thanks for your response. I have one followup. If the JSP that is calling
    our web app is being authenticated and served up via an Apache/Tomcat web
    server will the .Net object structure (page.user) still be built up when the
    ASP page gets initiated??

    "Dominick Baier" wrote:

    > Hi,
    >
    > 1) yes - that still works - it has nothing to do where the request comes
    > from - it has to enter the asp.net app which means IIS does authentication
    > and hands the information to asp.net
    >
    > 2) you can handle the End_Request event (e.g. in global.asax - if the status
    > code is 401 - do the redirect..)
    >
    > ---
    > Dominick Baier, DevelopMentor
    > http://www.leastprivilege.com
    >
    > > We are currently developing a corporate intranet app using ASP.Net 2.0
    > > app and wish to use Windows Integrated Security. I have developed a
    > > small test app that excercises the capabilities of using Windows
    > > authentication and I have two questions.
    > >
    > > First, we have a requirement that our app be launched from a link on
    > > the corporate intranet site which is implemented using JSP. Will the
    > > page.user property still be populated with the credentials created and
    > > authenticated at the time the user logged into the network when called
    > > from a JSP page??
    > >
    > > Second, I have set up my test app with a default page and two other
    > > pages. The two secondary pages are in their own directory and I have
    > > secured those directories using the authorization tag in the
    > > web.config file (example below)
    > >
    > > <authorization>
    > > <deny users="?" />
    > > <allow roles="XXX\YYYYYY" />
    > > <deny users="*" />
    > > </authorization>
    > > When I try to access the secured page that I should not have access
    > > to, in the development environment I am simply presented with the
    > > default "access is denied" page. When I deploy the test app on IIS and
    > > access the secured page that I do not have access to I am presented
    > > with the Windows logon screen to supply a user id and password. If I
    > > supply a valid id and pw that does not have access to the AD group 3
    > > times I am then presented with the default "access is denied" page. Is
    > > there a way to suppress the login page and go directly to the "access
    > > is denied" page (trapping the failure and redirecting to another page
    > > is also acceptable)?
    > >
    > > Thanks in advance....
    > >

    >
    >
    >
     
    PaulB, Oct 2, 2006
    #3
  4. well- it has nothing to do where the request comes from - it has to do where
    the request goes to...

    in this case ASP.NET hosted in IIS - which does all the work for you - you
    can also easily test that...

    ---
    Dominick Baier, DevelopMentor
    http://www.leastprivilege.com

    > Dominick,
    >
    > Thanks for your response. I have one followup. If the JSP that is
    > calling our web app is being authenticated and served up via an
    > Apache/Tomcat web server will the .Net object structure (page.user)
    > still be built up when the ASP page gets initiated??
    >
    > "Dominick Baier" wrote:
    >
    >> Hi,
    >>
    >> 1) yes - that still works - it has nothing to do where the request
    >> comes from - it has to enter the asp.net app which means IIS does
    >> authentication and hands the information to asp.net
    >>
    >> 2) you can handle the End_Request event (e.g. in global.asax - if the
    >> status code is 401 - do the redirect..)
    >>
    >> ---
    >> Dominick Baier, DevelopMentor
    >> http://www.leastprivilege.com
    >>> We are currently developing a corporate intranet app using ASP.Net
    >>> 2.0 app and wish to use Windows Integrated Security. I have
    >>> developed a small test app that excercises the capabilities of using
    >>> Windows authentication and I have two questions.
    >>>
    >>> First, we have a requirement that our app be launched from a link on
    >>> the corporate intranet site which is implemented using JSP. Will the
    >>> page.user property still be populated with the credentials created
    >>> and authenticated at the time the user logged into the network when
    >>> called from a JSP page??
    >>>
    >>> Second, I have set up my test app with a default page and two other
    >>> pages. The two secondary pages are in their own directory and I have
    >>> secured those directories using the authorization tag in the
    >>> web.config file (example below)
    >>>
    >>> <authorization>
    >>> <deny users="?" />
    >>> <allow roles="XXX\YYYYYY" />
    >>> <deny users="*" />
    >>> </authorization>
    >>> When I try to access the secured page that I should not have access
    >>> to, in the development environment I am simply presented with the
    >>> default "access is denied" page. When I deploy the test app on IIS
    >>> and
    >>> access the secured page that I do not have access to I am presented
    >>> with the Windows logon screen to supply a user id and password. If I
    >>> supply a valid id and pw that does not have access to the AD group 3
    >>> times I am then presented with the default "access is denied" page.
    >>> Is
    >>> there a way to suppress the login page and go directly to the
    >>> "access
    >>> is denied" page (trapping the failure and redirecting to another
    >>> page
    >>> is also acceptable)?
    >>> Thanks in advance....
    >>>
     
    Dominick Baier, Oct 2, 2006
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Kevin Phifer

    Using a Page object within a Page object

    Kevin Phifer, Jan 2, 2004, in forum: ASP .Net
    Replies:
    4
    Views:
    843
    Steven Cheng[MSFT]
    Jan 6, 2004
  2. Adam Hartshorne
    Replies:
    1
    Views:
    365
    Victor Bazarov
    Mar 3, 2005
  3. momo898
    Replies:
    2
    Views:
    516
    bruce barker \(sqlwork.com\)
    Oct 12, 2006
  4. gishani ratnayake via .NET 247

    User Control Error : Object reference not set to an instance of an object.

    gishani ratnayake via .NET 247, Mar 11, 2005, in forum: ASP .Net Web Controls
    Replies:
    1
    Views:
    186
  5. torbs
    Replies:
    1
    Views:
    139
Loading...

Share This Page