Chapter 12. Security

for RuBoard

While Security considerations are fundamental to application design and should not be left for last, pedagogically it is easier to talk about security once the .NET application model, ASP.NET, and Web Services have already been introduced. This chapter introduces to you the fundamentals of .NET security. [1]

[1] Pedagogical reasons also dictate the form of the sample code. It is easier to demonstrate security by starting with an open environment and then showing you how to restrict operations. Real systems should start with the most restrictive security and then open up only as needed.

Security prevents a user or code from doing things it should not be allowed to do. Traditionally, security has focused on restricting user actions. .NET allows restrictions to be placed on executing code. For example, you can prevent certain sections of code from accessing certain files. This is particularly useful when you have public Web sites or services where it is impractical to create user accounts, and lock down files or other resources, for an unknown number of users. It is critical when you are executing code that was created by third parties.

It is important to realize that .NET security sits on top of the underlying operating system's security system. For the purposes of this chapter, the underlying operating system is assumed to be Windows 2000. While we will discuss some security issues associated with the underlying infrastructure, including Microsoft's Internet Information Server (IIS), we will go into some detail only with those parts of the security story that are relevant to .NET. [2]

[2] For more information about secure Web-based applications, read Designing Secure Web-Based Applications for Microsoft Windows 2000 by Michael Howard.

To give an example of the interaction of .NET security and the operating system, code always runs under some identity, or in other words, as some user id. Irrespective of the file creation .NET security permissions, if the file Access Control List (ACL) denies you the right to create a file, you will be unable to create a file.

What makes the security story so difficult to tell is that it often seems that you have to understand everything before you can do anything. For this reason, we will tell the security story several times, each time with a little more detail. At the end you will be able to understand the whole story.

The security story starts with an attempt to answer to two questions. The first is the authentication question: Who are you? The second is the authorization question: Do you have the right to do what you want? Under .NET this story takes two branches, because the "you" can be either a user identity or an identity associated with an assembly.

We start with a brief telling of the security story by showing how both these types of security exist in .NET. Although it is not needed immediately, a brief excursion into Internet security follows , so that we can use that information when we need it. Then we start the detailed narrative with role-based security in .NET.

for RuBoard


Application Development Using C# and .NET
Application Development Using C# and .NET
ISBN: 013093383X
EAN: 2147483647
Year: 2001
Pages: 158

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net