ASP.NET Security Architecture

This section provides an overview of the ASP.NET security infrastructure. The following illustration shows the relationships among the security systems in ASP.NET.

ASP.NET architecture

As the illustration shows, all Web clients communicate with ASP.NET applications through Microsoft Internet Information Services (IIS). IIS authenticates the request if required and then locates the requested resource (such as an ASP.NET application). If the client is authorized, the resource is made available.

When an ASP.NET application is running, it can use built-in ASP.NET security features. In addition, an ASP.NET application can use the security features of the .NET Framework. For more information, see Key Security Concepts.

Integrating ASP.NET Authentication with IIS

In addition to relying on the authentication capabilities of IIS, you can perform authentication in ASP.NET. When considering ASP.NET authentication, you should understand the interaction with IIS authentication services.

IIS assumes that a set of credentials maps to a Microsoft Windows NT account and that it should use those credentials to authenticate a user. There are three different kinds of authentication available in IIS 5.0 and IIS 6.0: basic, digest, and Windows Integrated Security (NTLM or Kerberos). You can select the type of authentication to use in IIS administrative services. For more information on IIS authentication, see the IIS documentation.

If users request a URL that maps to an ASP.NET application, the request and authentication information are handed off to the application. ASP.NET provides forms authentication. Forms authentication is a system by which unauthenticated requests are redirected to an ASP.NET Web page that you create. The user provides credentials and submits the page. If your application authenticates the request, the system issues an authentication ticket in a cookie that contains the credentials or a key for reacquiring the identity. Subsequent requests include an authentication ticket with the request.

ASP.NET Configuration File Security Settings

ASP.NET security settings are configured in the Machine.config and Web.config files. As with other configuration information, base settings and default settings are established in the Machine.config file in the Config subdirectory of the current .NET Framework installation. You can establish site-specific and application-specific settings (including overriding settings from the Machine.config file) in Web.config files in the Web site root and application root directories. Subdirectories inherit a directory's settings unless overridden by a Web.config file in the subdirectory. To see an example of the way in which the hierarchical configuration system works for security, see configSections Element (General Settings Schema).

There are three major subsections to a Web.config file: the authentication, authorization, and identity sections. The values for each security element are usually set in the Machine.config file and overridden as required in the application-level Web.config file. All subdirectories automatically inherit those settings. However, subdirectories can have their own configuration files that override inherited settings.

You can use the location configuration element to specify a particular file or directory to which settings should apply. For more information, see configSections Element (General Settings Schema) and Configuring Specific Files and Subdirectories. For more details about ASP.NET configuration in general, see ASP.NET Configuration Overview.

The following example shows the syntax of the security sections of a configuration file:

<authentication mode="[Windows|Forms| None]">
  <forms name="name" 
    loginUrl="url" 
    protection="[All|None|Encryption|Validation]"
    path="path" timeout="minutes"
    requireSSL="[true|false]" 
    slidingExpiration="[true|false]">
    <credentials passwordFormat="[Clear|MD5|SHA1]">
      <user name="********" 
        password="********"/>
      </credentials>
  </forms>
</authentication>

<authorization>
  <allow users="comma-separated list of users"
      roles="comma-separated list of roles" />
  <deny  users="comma-separated list of users"
      roles="comma-separated list of roles" />
</authorization>

<identity impersonate ="[true|false]"
  userName="domain\username"
  password="password" />

<trust level="[Full|High|Medium|Low|Minimal]" 
  originUrl=""/>

<securityPolicy>
  <trustLevel name="Full" policyFile="internal"/>
  <trustLevel name="High" policyFile="web_hightrust.config"/>
  <trustLevel name="Medium" policyFile="web_mediumtrust.config"/>
  <trustLevel name="Low"  policyFile="web_lowtrust.config"/>
  <trustLevel name="Minimal" policyFile="web_minimaltrust.config"/>
</securityPolicy>

The default settings for these elements are shown in the following table.

See Also

Concepts

ASP.NET Configuration Overview

Other Resources

Securing ASP.NET Web Sites

Key Security Concepts

Forms Authentication Provider