Windows NTFS authorization Code-access authorization

317 DOMAIN-NAME\GroupName For groups defined on the web server machine: MACHINE\GroupName

6.10.2.2 Windows NTFS authorization

This method of authorization works only in conjunction with Windows authentication. Because users are authenticated against Windows user accounts, access to resources can be allowed or denied by using built-in Windows security. Use the Windows administration tools to allow or deny access for specific users or groups to specific files within the web application. Because this is purely a Windows administration task and is not specifically related to .NET, it wont be discussed further here.

6.10.2.3 Code-access authorization

Code written on a web page or in a code-behind file can discover the username and role membership of the current user and use this information to modify program behavior. For example, application menu options could be disabled or removed if the user is not a member of a certain role. The current users information is available through the Page objects User property. This property is of type IPrincipal defined in the System.Security.Principal namespace. The IPrincipal type has a property called Identity, which provides information about the users identity. The type of the Identity property is IIdentity defined in the System.Security.Principal namespace. The IIdentity type has three properties: AuthenticationType A string that identifies the type of authentication that was used. Some common values are: Forms Forms authentication NTLM Integrated Windows authentication Digest Digest authentication Basic Basic authentication IsAuthenticated A Boolean value indicating whether the user has been authenticated. Name A string containing the username. 318 A web page can take action based on a username, using the following code: If Me.User.Identity.Name = SOME-DOMAIN\daveg Then Do something. Else Do something else. End If Role membership is tested by using the IsInRole method of the IPrincipal type. For example: If Me.User.IsInRoleSOME-DOMAIN\Employees Then Do something. Else Do something else. End If

6.10.3 Accessing Network Resources