Restrict users using Application_Acq uireRequestStat e?

[Dave]

We have an intranet application that is under Integrated security. So in
theory, anyone who has an Active Directory account in the company can access
my app.

So, to allow only certain users, I created a user table of domain accounts
and check these in the Application_Acq uireRequestStat e event by comparing the
Identity.Name to names in my table. If OK, I set a session variable
HasAccess to "1" since sessions are available in this event.

Then, on subsequent page requests, this event checks the
Request.IsAuthe nticated and then the Session["HasAccess"] to allow them in
or not.

Is this approach valid or is there a better way? It seems to work OK,
except I have webservices on the site as well which, when requested, also
fires the Application_Acq uireRequestStat e event BUT when I try to access the
Session variables, it returns a null object reference because it seems the
Session is never actually created by a webservice request.

[Scott Allen]

Hi Dave:

Session state is disabled by default for asmx, but you can change the
default.

Another idea is to organize authorized users into an Active Directory
group in your domain. Then you add an <authorizatio n> section to
web.config and restrict the app to just members of the group. No extra
code required!

--
Scott
http://www.OdeToCode.com/blogs/scott/

On Wed, 2 Mar 2005 09:59:06 -0800, "Dave"
<Da**@discussio ns.microsoft.co m> wrote:

We have an intranet application that is under Integrated security. So in
theory, anyone who has an Active Directory account in the company can access
my app.

So, to allow only certain users, I created a user table of domain accounts
and check these in the Application_Acq uireRequestStat e event by comparing the
Identity.Nam e to names in my table. If OK, I set a session variable
HasAccess to "1" since sessions are available in this event.

Then, on subsequent page requests, this event checks the
Request.IsAuth enticated and then the Session["HasAccess"] to allow them in
or not.

Is this approach valid or is there a better way? It seems to work OK,
except I have webservices on the site as well which, when requested, also
fires the Application_Acq uireRequestStat e event BUT when I try to access the
Session variables, it returns a null object reference because it seems the
Session is never actually created by a webservice request.