Solved

.NET Authentication & Authorizarion

Posted on 2004-04-29
2
304 Views
Last Modified: 2010-04-15
Hi All,

I'm in the process of designing a web application for the Internet (ie: non secure) I have to decide on the best authentication/authorization method for my scenario.

The scenario is as follows:

I have an arbitrary number of users using my application. Every user has to be authenticated. Each authenticated user belongs to a user group and each group has it's own database and sub-application permissions. Each group will have access to some reports and other data outputs.

The main authentication methods are:

Windows - can not use as all internet users will require windows accounts
Passport - it's a 3rd party and pay service
Certificate - Not feasible here
Forms(cookies) - This will be a problem as cookies can be hacked and the user can gain full access.

The last one would be session variables.

1) What are the big pros and cons with this method?
2) Can a user just somehow hack his own session variables and destroy my authentication method?
3) Are there major restrictions on the session variables?

Thanks
Peter



0
Comment
Question by:Pete2003
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 9

Accepted Solution

by:
msdixon earned 200 total points
ID: 10950510
i think you're confusing authentication schemes with user information storage

i would suggest using forms authentication, and storing session information in a session variable(s), and the database. you may use sql server for your session information storage (it's a minor web.config modification), and store other neccesary info in the database. typically, i like to store as little information in sessions as possible (like a guid of the user id), and look up the information when i need it.
0
 

Author Comment

by:Pete2003
ID: 10953367
Thanks for the reply ...

I'm using Oracle as my database ... and I do not want to save the login information on the database since if I have a lot of simultaneous users it will cause congestion ... I would like to use Session variables ... I am however not very well versed there ... could you provide some links or some information on how to use the session variables with some examples if possible ...

Also are session variables more safe & secure (relatively speaking) then other methods ?

Thanks
Peter
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Article by: Najam
Having new technologies does not mean they will completely replace old components.  Recently I had to create WCF that will be called by VB6 component.  Here I will describe what steps one should follow while doing so, please feel free to post any qu…
This article is for Object-Oriented Programming (OOP) beginners. An Interface contains declarations of events, indexers, methods and/or properties. Any class which implements the Interface should provide the concrete implementation for each Inter…
In a recent question (https://www.experts-exchange.com/questions/29004105/Run-AutoHotkey-script-directly-from-Notepad.html) here at Experts Exchange, a member asked how to run an AutoHotkey script (.AHK) directly from Notepad++ (aka NPP). This video…
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question