Security

ASP.NET works together with IIS and Windows to provide several different security options for your web application. The key points to remember for the exam are what authentication options are available, and how to configure them in .NET and IIS.

Authentication, Authorization, and Impersonation

These three terms are used thoroughly when discuss security in general, and are covered on the exam. For clarification purposes to those unfamiliar with the differences between the terms, we include definitions here.

Authentication	The process of verifying that the user is who they claim to be, usually through some username/password verification scheme
Authorization	The process of verifying what resources an authenticated user has access to
Impersonation	The process of having the ASP.NET worker process run as an authenticated or anonymous user so that authorization checks can be performed

Configuring Authentication

Authentication refers to how a user's identify is verified. There are 4 different authentication options:

Windows	Users are authenticated using their Windows domain accounts. This works in conjunction with IIS security.
Forms	Users are redirected to an HTML form for entering in usernames and passwords.
Passport	Users are authenticated using the Microsoft Passport service.
None	Users are not authenticated

Authentication is configured in the web.config file for the application. The <authentication> section of the web.config file looks like this: For forms authentication, the <forms> tag provides settings for the name of the cookie given to the user (.ASPAUTHX is the default), and the path to the login form for non-authenticated users. For passport authentication, the <passport> tag allows you to indicate a redirect page after the user is authenticated. Otherwise, the passport service redirects a user to the page he/she originally requested.

Web.config Examples

Windows Authentication

Forms Authentication

Passport Authentication