Page 250 - DCAP312_WEB_TECHNOLOGIES_II

Web Technologies-II

Notes that it requires minimal coding. We may want to use Windows authentication to impersonate
the Windows user account that IIS authenticates before we hand off the request to ASP.NET.
The WindowsAuthenticationModule Provider Following:
• In windows integrated authentication, passwords never cross the network.
• Users must still have a username and password, but the application uses either the Kerberos
or challenge/response protocols authenticate the user.
• Windows-integrated authentication requires that all users be running internet explorer
3.01 or later Kerberos is a network authentication protocol.
• It is designed to provide strong authentication for client/server applications by using
secret-key cryptography.
• Kerberos is a solution to network security problems. It provides the tools of authentication
and strong cryptography over the network to help to secure information in systems across
entire enterprise.

Passport Authentication
Passport authentication is a centralized authentication service, which Microsoft provides, that
offers a single log on and core profile services for member sites. Typically, Passport authentication
is used when we need single log on capability across multiple domains.
The Passport Authentication Provider or following:

• Passport authentication makes use of Microsoft’s passport service to authenticate users
of application.

• If users have signed up with passport and we configure the authentication mode of the
application to the passport authentication, all authentication duties are off-loaded to the
passport servers.
• Passport uses an encrypted cookie mechanism to indicate authenticated users. If users have
already signed into passport when they visit our site, they will be considered authenticated
by ASP.NET. Otherwise they will be redirected to the passport servers to log in. When
they are successfully log in, they will be redirected back to your site.
• To use passport authentication we have to download the Passport Software Development
Kit (SDK) and install it on our server. The SDK can be found at.
Default Authentication
Default authentication is used when we do not want any security on Web application; anonymous
access is required for this security provider. Among all authentication providers, Default
authentication provides maximum performance for your application. This authentication provider
is also used when we use your own custom security module.
Forms Authentication

Forms authentication refers to a system in which unauthenticated requests are redirected to a
Hypertext Markup Language (HTML) form in which users type their credentials. After the user
provides credentials and submits the form, the application authenticates the request, and the
system issues an authorization ticket in the form of a cookie. This cookie contains the credentials
or a key to reacquire the identity. Subsequent requests from the browser automatically include
the cookie.

244 LOVELY PROFESSIONAL UNIVERSITY