Configuring Authorization

Add a new Visual C# ASP.NET application named StepByStep11_6 to the solution. Add some text to the default Web form so that you can later verify that it displays properly.

In Windows, select Start, Programs, Administrative Tools, Internet Services Manager.

In Internet Services Manager, drill down into the tree view until you find the node that corresponds to your Visual C# ASP.NET application. This node will have the same name as the application and will be located beneath the Default Web Site node. Right-click the application node and select Properties.

In the Properties dialog box, click the Directory Security tab. Click the Edit button in the Anonymous Access And Authentication Methods section to open the Authentication Methods dialog box.

Uncheck the Anonymous Access check box. Check the Basic authentication check box.

Click Yes if you receive a security warning, and then click OK twice to save your changes.

Add a new Web form to your Visual C# ASP.NET application. Name the new form StepByStep11_6.aspx.

Place a TextBox control (txtAuthenticatedUser) on the form.

Switch to code view and add the following using directive:

using System.Security.Principal;

Add the following code to the Page_Load() event handler (you'll learn about the Identity and Principal objects in the next section of the chapter):

private void Page_Load(

    object sender, System.EventArgs e)

{

    WindowsIdentity wi = WindowsIdentity.GetCurrent();

    txtAuthenticatedUser.Text = wi.Name;

}

Edit the web.config file to replace both the <authentication> and <authorization> elements as follows:

<authentication mode="Windows">

</authentication>



<authorization>

   <allow users="*" />

</authorization>

Set the new Web form as the start page for the project. Set the project as the startup project.

Run the solution. Log in using a Windows username and password. (Depending on your network configuration, you may not receive a login prompt at this point.) The form will display the name of the ASP.NET user (which will be something like DOMAIN\ASPNET) because you don't have impersonation turned on at this point.

Stop the project. Edit the web.config file to include impersonation:

<authentication mode="Windows">

</authentication>

<identity impersonate="true" />



<authorization>

   <allow users="*" />

</authorization>

Run the solution again. Log in using a Windows username and password. The form will display the username and domain that you supplied for authentication, indicating that the ASP.NET process has taken on the identity of the authenticated user.

Add a new Visual C# .NET Windows application named StepByStep11_7 to the solution.

In the Solution Explorer, rename the default Form1.cs to StepByStep11_7.cs. Open the form in code view and change all occurrences of Form1 to refer to StepByStep11_7 instead.

Place a ListBox control named lbProperties and a Button control named btnGetProperties on the form.

Switch to the code view and add the following using directive:

using System.Security.Principal;

Double-click the Button control and add the following code to retrieve properties when the Button control is clicked:

private void btnGetProperties_Click(object sender,

   System.EventArgs e)

{

    // Tell the CLR which principal policy is in use

    AppDomain.CurrentDomain.SetPrincipalPolicy(

       PrincipalPolicy.WindowsPrincipal);

    lbProperties.Items.Clear();



    // Get the current identity

    WindowsIdentity wi = WindowsIdentity.GetCurrent();

    // Dump its properties to the listbox

    lbProperties.Items.Add("WindowsIdentity:");

    lbProperties.Items.Add("  Authentication type: " +

       wi.AuthenticationType);

    lbProperties.Items.Add("  Is Anonymous: " +

       wi.IsAnonymous);

    lbProperties.Items.Add("  Is Authenticated: " +

       wi.IsAuthenticated);

    lbProperties.Items.Add(

        "  Is Guest: " + wi.IsGuest);

    lbProperties.Items.Add(

        "  Is System: " + wi.IsSystem);

    lbProperties.Items.Add("  Name: " + wi.Name);

    lbProperties.Items.Add("  Token: " +

       wi.Token.ToString());



    // Get the current principal

    WindowsPrincipal prin = new WindowsPrincipal(wi);

    // Dump its properties to the listbox

    lbProperties.Items.Add("WindowsPrincipal:");

    lbProperties.Items.Add("  Authentication Type: " +

        prin.Identity.AuthenticationType);

    lbProperties.Items.Add("  Is Authenticated: "  +

        prin.Identity.IsAuthenticated);

    lbProperties.Items.Add("  Name: " +

        prin.Identity.Name);

    lbProperties.Items.Add("  Member of Users: " +

        prin.IsInRole(@"INFINITY\Users"));

}

Set the project as the startup project.

Run the project and click the Get Properties button. You should see output similar to that in Figure.

Add a new Visual C# .NET Windows application named StepByStep11_8 to the solution.

In the Solution Explorer, rename the default Form1.cs to StepByStep11_8.cs. Open the form in code view and change all occurrences of Form1 to refer to StepByStep11_8 instead.

Place a Label control (lblMembership) on the form.

Switch to the code view and add the following using directives:

using System.Security.Principal;

using System.Threading;

Double-click the form and add the following code to handle the Load event of the form:

private void StepByStep11_8_Load(object sender,

   System.EventArgs e)

{

    // Tell the CLR to use Windows security

    AppDomain.CurrentDomain.SetPrincipalPolicy(

       PrincipalPolicy.WindowsPrincipal);

    // Get the current principal object

    WindowsPrincipal prin =

       (WindowsPrincipal) Thread.CurrentPrincipal;

    // Determine whether the user is an admin

    Boolean fAdmin = prin.IsInRole(

       WindowsBuiltInRole.Administrator);

    // Display the results on the UI

    if(fAdmin)

        lblMembership.Text =

           "You are in the Administrators group";

    else

        lblMembership.Text =

           "You are not in the Administrators group";

}

Set the project as the startup project.

Run the project. The form will tell you whether or not you're in the Administrators group.

Add a new Visual C# .NET Windows application named StepByStep11_9 to the solution.

In the Solution Explorer, rename the default Form1.cs to StepByStep11_9.cs. Open the form in code view and change all occurrences of Form1 to refer to StepByStep11_9 instead.

Switch to the code view and add the following using directives:

using System.Security.Permissions;

using System.Security.Principal;

Double-click the form and add the following code, which should run when the form is loaded:

private void StepByStep11_9_Load(object sender,

   System.EventArgs e)

{

    // Tell the CLR to use Windows security

    AppDomain.CurrentDomain.SetPrincipalPolicy(

      PrincipalPolicy.WindowsPrincipal);

    // Create a new PrincipalPermission object

    // This object matches any user

    // in a group named Developers

    PrincipalPermission pp = new PrincipalPermission(

        null, "Developers");

    // See whether the user is in the group

    try

    {

        pp.Demand();

        MessageBox.Show(

            "You are in the Developers group");

    }

    catch (Exception ex)

    {

        MessageBox.Show("Exception: " + ex.Message);

    }

}

Set the project as the startup project.

Run the project. If you're a member of a group named Developers, you see a message box that tells you so. If you are not a member of that group, you see a security exception message from the PrincipalPermission class, telling you that the requested permission could not be granted.