Authentication help.

[archana]

Hi all

I am new to asp.net. I want to implement authentication in all pages.
What i want to do is validate user from database table. So currently
what i am doing is on login page validating user and storing valid
user id in sesstion.

On every page i am checking userid from session.. But i don't want to
behavirour. what i want is to provide authentication to all pages
once not on every page .

So how will i do this. And if session expire in between what will
happen if user try to access the page after that.

Please correct me if i am wrong in any concept.

thanks in advance.

[Just Me]

You need an authentication section in the web.config, once the user has
authenticated then they will be able to access your pages.
"archana" <tr************ **@yahoo.comwro te in message
news:11******** **************@ i13g2000prf.goo glegroups.com.. .

Hi all

I am new to asp.net. I want to implement authentication in all pages.
What i want to do is validate user from database table. So currently
what i am doing is on login page validating user and storing valid
user id in sesstion.

On every page i am checking userid from session.. But i don't want to
behavirour. what i want is to provide authentication to all pages
once not on every page .

So how will i do this. And if session expire in between what will
happen if user try to access the page after that.

Please correct me if i am wrong in any concept.

thanks in advance.

[archana]

Hi,

thanks for reply.
but what authentication do i need to use as i have to validate
username in database.

So how will i combine this with form/windows authentication?

please help me asap.

thanks.

[Kevin Spencer]

Your best bet is to use A Membership or Role Provider and Forms
Authentication in your application. The Provider Model is built in to the
ASP.Net Framework, can work from a custom database back-end, and manages
permissions across the web application in a uniform, easy to maintain
manner. In addition, it can be combined with XML Site Maps for
login-specific menuing that is handled automatically. See the following
references:

http://msdn2.microsoft.com/en-us/library/aa479030.aspx
http://msdn2.microsoft.com/en-us/library/aa530801.aspx
http://msdn2.microsoft.com/en-us/library/aa478958.aspx

--
HTH,

Kevin Spencer
Chicken Salad Surgeon
Microsoft MVP

"archana" <tr************ **@yahoo.comwro te in message
news:11******** **************@ v29g2000prd.goo glegroups.com.. .

Hi,

thanks for reply.
but what authentication do i need to use as i have to validate
username in database.

So how will i combine this with form/windows authentication?

please help me asap.

thanks.

[mark4asp]

On 22 Oct, 06:16, archana <trialproduct2. [e-mail] te:

Hi all

I am new to asp.net. I want to implement authentication in all pages.
What i want to do is validate user from database table. So currently
what i am doing is on login page validating user and storing valid
user id in sesstion.

On every page i am checking userid from session.. But i don't want to
behavirour. what i want is to provide authentication to all pages
once not on every page .

So how will i do this. And if session expire in between what will
happen if user try to access the page after that.

Please correct me if i am wrong in any concept.

thanks in advance.

No need to keep checking the session. For example with forms
authentificatio n:

(1) Include a forms authentificatio n entry something like the one
below:

<authenticati on mode="Forms">
<forms name="mydomain" loginUrl="~/Default.aspx" defaultUrl="~/
News/News.aspx" protection="All " cookieless="Aut oDetect"
slidingExpirati on="true" timeout="30"/>
</authentication>

The forms authentificatio n entry above allows users with a good cookie
set to go straight to the "~/News/News.aspx", the defaultUrl. Users
whose cookies fail authentificatio n will land at the login page (see
(4) below).

(2) You may need to edit your machineKey entry too, so that you can
deal with encrypted cookies, etc.:

<machineKey decryption="AES " validation="SHA 1"
decryptionKey=" _____,IsolateAp ps" validationKey=" _____,IsolateAp ps"/>

The underlined bits in the above code are where you put your keys.
These are big hexadecimal numbers.

(3) Each area of the site needs to be told what sorts of users are
allowed to visit those pages. In the entry below, all files inside the
Administration directory are being made available to users who are in
any one of 4 mwAdmin_ roles: Super,Editor,De mo,Full. These roles are
just some text which I store in the user's encrypted cookie.

<location path="Administr ation">
<system.web>
<authorizatio n>
<allow
roles="mwAdmin_ Super,mwAdmin_E ditor,mwAdmin_D emo,mwAdmin_Ful l"/>
<deny users="*"/>
</authorization>
</system.web>
</location>

You will need a separate entry like this for each individual page in
your root but only one entry is needed for directories containing
files provided that the files within a subdirectory have the same
security settings.

(4) The process of checking whether your visitors have their cookies
set is done in Global.asax, in the
FormsAuthentica tion_OnAuthenti cate() event - which you may need to
add. In general, I (a) read their cookie and get their ticket. (b) I
get their userID from the ticket, (c) then look up the database to get
their roles and the period for which their cookie remains valid. (d)
make the user:
User user = new User(Ticket.Nam e, strRoles, PersistentCooki eDays,
iLoginId);
I then write this information to a new ticket and store it back to
their cookie. (e) If they're an authentic user I add their userID to
the their security Context. Google to find some examples.

[mark4asp]

On 22 Oct, 15:19, mark4asp <mark4...@gmail .comwrote:

On 22 Oct, 06:16, archana <trialproduct2. [e-mail] te:

Hi all

I am new to asp.net. I want to implement authentication in all pages.

Ooops I forgot, check out: <http://forums.asp.net/thread/1177390.aspx>
for FormsAuthentica tion_OnAuthenti cate() event.