How To Secure an ASP.NET Application by Using Windows Security

Requirements

• Windows 2000 Server Service Pack 2
• IIS 5.0
• Windows Server 2003 with IIS 6.0
• Microsoft Internet Explorer 6.0
• Microsoft Visual Studio .NET

• ASP.NET development with Visual Basic .NET
• IIS administration
• Windows 2000 user account administration

How to Develop the Web Site

1. Start Visual Studio .NET, and then create a new Visual Basic ASP.NET Web application named "WindowsSite."
2. Drag a label control from the toolbox onto the WebForm1.aspx Web form, and then set its ID property to
   authUserPrincipalLabel.
3. Drag a second label control from the toolbox onto the WebForm1.aspx Web form, and then set its ID property to
   aspPrincipalLabel.
4. Double-click WebForm1.aspx to view the code window, and then add the following Imports statement above the class declaration:

   Imports System.Security
   

   Add the following code to the Page_Load event procedure:

   Dim authUserName As String
   Dim aspUserName As String
   authUserName = User.Identity.Name
   aspUserName = Principal.WindowsIdentity.GetCurrent.Name
   authUserPrincipalLabel.Text = "You are: " & authUserName
   aspPrincipalLabel.Text = "This page runs as: " & aspUserName
   

5. View the project's Web.config file, and then locate the
   authentication element. Verify that the mode attribute has a value of Windows.
6. Build and save the project.
7. Run the project, and then confirm that the page is displayed with the following message:
   • In Windows 2000
     You are:
     This page runs as: DomainOrServer\ASPNET
     
   • In Windows Server 2003
     You are:
     This page runs as: DomainOrServer\NETWORK SERVICE
   Note Your user name is not displayed because you have not been authenticated by IIS; anonymous access is still enabled.
8. Quit Internet Explorer to stop the project.

How to Disable Anonymous Access

1. Minimize Visual Studio, and then start Internet Services Manager from the Administrative Tools program group.
2. Expand your server and its default Web site, right-click the WindowsSite site, and then click Properties.
3. On the Directory Security tab in the WindowsSite Properties dialog box, click the Edit button in the "Anonymous access and authentication control" section.
4. Click to clear the Anonymous access check box, verify that the Integrated Windows authentication check box is selected, and then click OK.
5. Click OK to close the WindowsSite Properties dialog box.
6. Switch back to Visual Studio, and then run the project. Confirm that the page is displayed with the following message:
   • In Windows 2000
     You are: Your Windows user name
     This page runs as: DomainOrServer\ASPNET
     
   • In Windows Server 2003
     You are: Your Windows user name
     This page runs as: DomainOrServer\NETWORK SERVICE
     
   Note You have been authenticated through your Windows account. If you had not been logged on to Windows, you would have been prompted for a Windows user name and password.
7. Quit Internet Explorer to stop the project.

Authorization

<configuration>
     <system.web>
       <authorization>
         <allow roles="domainname\Managers" />
         <deny users="*" />
       </authorization>
     </system.web>
   </configuration>

<configuration>
     <system.web>
       <authorization>
         <allow users="domainname\user1,domainname\user2,domainname\user3" />
         <deny users="*" />
       </authorization>
     </system.web>
   </configuration>

How to Enable Impersonation

1. In Visual Studio, view the Web.config file for the WindowsSite project.
2. Add the following element after the
   authentication element:

   <identity impersonate = "true" />
   

3. Save Web.config.
4. Run the project. Confirm that the page is displayed with the following message (note that the ASP.NET execution engine will use your Windows credentials to access resources on your behalf):
   You are: Your Windows user name
   This page runs as: Your Windows user name
5. Quit Internet Explorer to stop the project.

How to Assign a Custom Principal

1. Start the Computer Management feature from the Administrative Tools program group. Create a new Windows 2000 user account named "WindowsSite," with a password of "password" (note whether your server is a domain controller, and then use the Active Directory Users and Computers tool).
2. Click to clear the User must change password at next logon check box.Note The custom principal that you select must have the permissions that are outlined in the following Knowledge Base article:
   
   317012 INFO: Process and Request Identity in ASP.NET
   
3. When the WindowsSite account has been created, close the administrative tool that you used to create it.
4. In Visual Studio, view the Web.config file for the WindowsSite project.
5. Edit the identity element to read as follows:

   
   identity impersonate = "true"
          userName = " DomainOrServerName \WindowsSite" 
          password = "password"/>
    

   where DomainOrServerName is either the name of your Windows 2000 or Windows Server 2003 domain (in a domain environment) or of your computer (in a workgroup environment).
6. Save Web.config.
7. Run the project. Confirm that the page is displayed with the following message:
   You are: Your Windows user name
   This page runs as: DomainOrServerName\WindowsSite
   
   Note Aspnet_wp.exe will use the Windows credentials that you specified to access resources on your behalf.
8. Quit Internet Explorer to stop the project.

• On Windows 2000, by default, the Aspnet_wp.exe process runs under a computer account that is named ASPNET.
  
• On Windows Server 2003, by default, the Aspnet_wp.exe process runs under a computer account that is named NetworkService. However, this account does not have the correct privileges to impersonate a specific user. You receive an error message if you try to impersonate a specific user.

• Grant the Act as part of the operating system privilege to the ASPNET account (the least privileged account).
  
  Note Although you can use this method to work around the problem, Microsoft does not recommend this method.
• Change the account that the Aspnet_wp.exe process runs under to the System account in the <processModel> configuration section of the Machine.config file.

Troubleshooting