Building Secure Microsoft® ASP.NET Applications

Larger Cover

By Microsoft Corporation

Publisher: Microsoft Press

Released: January 2003

Pages: 620

Building secure distributed Web applications can be challenging. It usually involves integrating several different technologies and products—yet your complete application will only be as secure as its weakest link. This guide presents a practical, scenario-driven approach to designing and building security-enhanced ASP.NET applications for Microsoft® Windows® 2000 and version 1.1 of the Microsoft .NET Framework. It focuses on the key elements of authentication, authorization, and secure communication within and across the tiers of distributed .NET Web applications.

This guide focuses on:

Authentication—to identify the clients of your application
Authorization—to provide access controls for those clients
Secure communication—to help ensure that messages remain private and are not altered by unauthorized parties

Who should read this guide:

Middleware developers and architects who build or plan to build .NET Web applications using ASP.NET, XML Web Services, Enterprise Services (COM+), .NET Remoting, or Microsoft ADO.NET

About “Patterns and Practices”:

Patterns & Practices contain specific recommendations illustrating how to design, build, deploy, and operate architecturally sound solutions to challenging business and technical scenarios. The technical guidance is reviewed and approved by Microsoft engineering teams, consultants, and Product Support Services, and by partners and customers.

Note: Includes complete sample on the Web.

Chapter 1 Introduction
1. The Connected Landscape
2. The Foundations
3. Tying the Technologies Together
4. Design Principles
5. Summary
Chapter 2 Security Model for ASP.NET Applications
1. .NET Web Applications
2. Implementation Technologies
3. Security Architecture
4. Introducing .NET Framework Security
5. Summary
Chapter 3 Authentication and Authorization Design
1. Designing an Authentication and Authorization Strategy
2. Authorization Approaches
3. Flowing Identity
4. Role-Based Authorization
5. Choosing an Authentication Mechanism
6. Summary
Chapter 4 Secure Communication
1. Know What to Secure
2. SSL/TLS
3. IPSec
4. RPC Encryption
5. Point to Point Security
6. Choosing Between IPSec and SSL
7. Farming and Load Balancing
8. Summary
Chapter 5 Intranet Security
1. ASP.NET to SQL Server
2. ASP.NET to Enterprise Services to SQL Server
3. ASP.NET to Web Services to SQL Server
4. ASP.NET to Remoting to SQL Server
5. Flowing the Original Caller to the Database
6. Summary
Chapter 6 Extranet Security
1. Exposing a Web Service
2. Exposing a Web Application
3. Summary
Chapter 7 Internet Security
1. ASP.NET to SQL Server
2. ASP.NET to Remote Enterprise Services to SQL Server
3. Summary
Chapter 8 ASP.NET Security
1. ASP.NET Security Architecture
2. Authentication and Authorization Strategies
3. Configuring Security
4. Programming Security
5. Windows Authentication
6. Forms Authentication
7. Passport Authentication
8. Custom Authentication
9. Process Identity for ASP.NET
10. Impersonation
11. Accessing System Resources
12. Accessing COM Objects
13. Accessing Network Resources
14. Secure Communication
15. Storing Secrets
16. Securing Session and View State
17. Web Farm Considerations
18. Summary
Chapter 9 Enterprise Services Security
1. Security Architecture
2. Configuring Security
3. Programming Security
4. Choosing a Process Identity
5. Accessing Network Resources
6. Flowing the Original Caller
7. RPC Encryption
8. Building Serviced Components
9. DCOM and Firewalls
10. Calling Serviced Components from ASP.NET
11. Security Concepts
12. Summary
Chapter 10 Web Services Security
1. Web Service Security Model
2. Platform/Transport Security Architecture
3. Authentication and Authorization Strategies
4. Configuring Security
5. Passing Credentials for Authentication to Web Services
6. Flowing the Original Caller
7. Trusted Subsystem
8. Accessing System Resources
9. Accessing Network Resources
10. Accessing COM Objects
11. Using Client Certificates with Web Services
12. Secure Communication
13. Summary
Chapter 11 .NET Remoting Security
1. .NET Remoting Architecture
2. .NET Remoting Gatekeepers
3. Authentication
4. Authorization
5. Authentication and Authorization Strategies
6. Accessing System Resources
7. Accessing Network Resources
8. Passing Credentials for Authentication to Remote Objects
9. Flowing the Original Caller
10. Trusted Subsystem
11. Secure Communication
12. Choosing a Host Process
13. Remoting vs. Web Services
14. Summary
Chapter 12 Data Access Security
1. Introducing Data Access Security
2. Authentication
3. Authorization
4. Secure Communication
5. Connecting with Least Privilege
6. Creating a Least Privilege Database Account
7. Storing Database Connection Strings Securely
8. Authenticating Users against a Database
9. SQL Injection Attacks
10. Auditing
11. Process Identity for SQL Server
12. Summary
Chapter 13 Troubleshooting Security Issues
1. Process for Troubleshooting
2. Troubleshooting Authentication Issues
3. Troubleshooting Authorization Issues
4. ASP.NET
5. Determining Identity
6. .NET Remoting
7. SSL
8. IPSec
9. Auditing and Logging
10. Troubleshooting Tools

Appendix Index of How Tos
1. ASP.NET
2. Authentication and Authorization
3. Cryptography
4. Enterprise Services Security
5. Web Services Security
6. Remoting Security
7. Secure Communication
Appendix How To: Create a Custom Account to Run ASP.NET
1. ASP.NET Worker Process Identity
2. Impersonating Fixed Identities
3. Notes
4. Summary
5. Create a New Local Account
6. Assign Minimum Privileges
7. Assign NTFS Permissions
8. Configure ASP.NET to Run Using the New Account
Appendix How To: Use Forms Authentication with Active Directory
1. Requirements
2. Summary
3. Create a Web Application with a Logon Page
4. Configure the Web Application for Forms Authentication
5. Develop LDAP Authentication Code to Look Up the User in Active Directory
6. Develop LDAP Group Retrieval Code to Look Up the User’s Group Membership
7. Authenticate the User and Create a Forms Authentication Ticket
8. Implement an Authentication Request Handler to Construct a GenericPrincipal Object
9. Test the Application
Appendix How To: Use Forms Authentication with SQL Server 2000
1. Requirements
2. Summary
3. Create a Web Application with a Logon Page
4. Configure the Web Application for Forms Authentication
5. Develop Functions to Generate a Hash and Salt value
6. Create a User Account Database
7. Use ADO.NET to Store Account Details in the Database
8. Authenticate User Credentials Against the Database
9. Test the Application
10. Additional Resources
Appendix How To: Create GenericPrincipal Objects with Forms Authentication
1. Requirements
2. Summary
3. Create a Web Application with a Logon Page
4. Configure the Web Application for Forms Authentication
5. Generate an Authentication Ticket for Authenticated Users
6. Construct GenericPrincipal and FormsIdentity Objects
7. Test the Application
Appendix How To: Implement Kerberos Delegation for Windows 2000
1. Notes
2. Requirements
3. Summary
4. Confirm that the Client Account is Configured for Delegation
5. Confirm that the Server Process Account is Trusted for Delegation
6. References
Appendix How To: Implement IPrincipal
1. Requirements
2. Summary
3. Create a Simple Web Application
4. Configure the Web Application for Forms Authentication
5. Generate an Authentication Ticket for Authenticated Users
6. Create a Class that Implements and Extends IPrincipal
7. Create the CustomPrincipal Object
8. Test the Application
9. Additional Resources
Appendix How To: Create a DPAPI Library
1. Notes
2. Requirements
3. Summary
4. Create a C# Class Library
5. Strong Name the Assembly (Optional)
6. References
Appendix How To: Use DPAPI (Machine Store) from ASP.NET
1. Notes
2. Summary
3. Create an ASP.NET Client Web Application
4. Test the Application
5. Modify the Web Application to Read an Encrypted Connection String from Web.Config
6. References
Appendix How To: Use DPAPI (User Store) from ASP.NET with Enterprise Services
1. Notes
2. Requirements
3. Summary
4. Create a Serviced Component that Provides Encrypt and Decrypt Methods
5. Call the Managed DPAPI Class Library
6. Create a Dummy Class that will Launch the Serviced Component
7. Create a Windows Account to Run the Enterprise Services Application and Windows Service
8. Configure, Strong Name, and Register the Serviced Component
9. Create a Windows Service Application that will Launch the Serviced Component
10. Install and Start the Windows Service Application
11. Write a Web Application to Test the Encryption and Decryption Routines
12. Modify the Web Application to Read an Encrypted Connection String from an Application Configuration File
13. References
Appendix How To: Create an Encryption Library
1. Requirements
2. Summary
3. Create a C# Class Library
4. Create a Console Test Application
5. References
Appendix How To: Store an Encrypted Connection String in the Registry
1. Notes
2. Requirements
3. Summary
4. Store the Encrypted Data in the Registry
5. Create an ASP.NET Web Application
6. References
Appendix How To: Use Role-based Security with Enterprise Services
1. Notes
2. Requirements
3. Summary
4. Create a C# Class Library Application to Host the Serviced Component
5. Create the Serviced Component
6. Configure the Serviced Component
7. Generate a Strong Name for the Assembly
8. Build the Assembly and Add it to the Global Assembly Cache
9. Manually Register the Serviced Component
10. Examine the Configured Application
11. Create a Test Client Application
Appendix How To: Call a Web Service Using Client Certificates from ASP.NET
1. Why Use a Serviced Component?
2. Requirements
3. Summary
4. Create a Simple Web Service
5. Configure the Web Service Virtual Directory to Require Client Certificates
6. Create a Custom Account for Running the Serviced Component
7. Request a Client Certificate for the Custom Account
8. Test the Client Certificate Using a Browser
9. Export the Client Certificate to a File
10. Develop the Serviced Component Used to Call the Web Service
11. Configure and Install the Serviced Component
12. Develop a Web Application to Call the Serviced Component
13. Additional Resources
Appendix How To: Call a Web Service Using SSL
1. Requirements
2. Summary
3. Create a Simple Web Service
4. Configure the Web Service Virtual Directory to Require SSL
5. Test the Web Service Using a Browser
6. Install the Certificate Authority’s Certificate on the Client Computer
7. Develop a Web Application to Call the Web Service
8. Additional Resources
Appendix How To: Host a Remote Object in a Windows Service
1. Notes
2. Requirements
3. Summary
4. Create the Remote Object Class
5. Create a Windows Service Host Application
6. Create a Windows Account to Run the Service
7. Install the Windows Service
8. Create a Test Client Application
9. References
Appendix How To: Set Up SSL on a Web Server
1. Requirements
2. Summary
3. Generate a Certificate Request
4. Submit a Certificate Request
5. Issue the Certificate
6. Install the Certificate on the Web Server
7. Configure Resources to Require SSL Access
Appendix How To: Set Up Client Certificates
1. Requirements
2. Summary
3. Create a Simple Web Application
4. Configure the Web Application to Require Client Certificates
5. Request and Install a Client Certificate
6. Verify Client Certificate Operation
7. Additional Resources
Appendix How To: Use IPSec to Provide Secure Communication Between Two Servers
1. Notes
2. Requirements
3. Summary
4. Create an IP Filter
5. Create Filter Actions
6. Create Rules
7. Export the IPSec Policy to the Remote Computer
8. Assign Policies
9. Verify that it Works
10. Additional Resources
Appendix How To: Use SSL to Secure Communication with SQL Server 2000
1. Notes
2. Requirements
3. Summary
4. Install a Server Authentication Certificate
5. Verify that the Certificate Has Been Installed
6. Install the Issuing CA’s Certificate on the Client
7. Force All Clients to Use SSL
8. Allow Clients to Determine Whether to Use SSL
9. Verify that Communication is Encrypted
10. Additional Resources
Appendix Base Configuration
Appendix Configuration Stores and Tools
Appendix Reference Hub
1. Searching the Knowledge Base
2. .NET Security
3. Active Directory
4. ADO.NET
5. ASP.NET
6. Enterprise Services
7. IIS (Internet Information Server)
8. Remoting
9. SQL Server
10. Visual Studio .NET
11. Web Services
12. Windows 2000
Appendix How Does It Work?
1. IIS and ASP.NET Processing
2. ASP.NET Pipeline Processing
Appendix ASP.NET Identity Matrix
Appendix Cryptography and Certificates
1. Keys and Certificates
2. Cryptography
3. Summary
Appendix .NET Web Application Security
Glossary
Appendix Microsoft® patterns & practices

Title:

Building Secure Microsoft® ASP.NET Applications

By:

Microsoft Corporation

Publisher:

Microsoft Press

Formats:

Print
Ebook
Safari Books Online

Print:

January 2003

Ebook:

November 2009

Pages:

620

Print ISBN:

978-0-7356-1890-9

| ISBN 10:

0-7356-1890-9

Ebook ISBN:

978-0-7356-3022-2

| ISBN 10:

0-7356-3022-4

Description

Table of Contents

Product Details

About the Author

Recommended for You

Chapter 1 Introduction

The Connected Landscape

The Foundations

Tying the Technologies Together

Design Principles

Summary

Chapter 2 Security Model for ASP.NET Applications

.NET Web Applications

Implementation Technologies

Security Architecture

Introducing .NET Framework Security

Summary

Chapter 3 Authentication and Authorization Design

Designing an Authentication and Authorization Strategy

Authorization Approaches

Flowing Identity

Role-Based Authorization

Choosing an Authentication Mechanism

Summary

Chapter 4 Secure Communication

Know What to Secure

SSL/TLS

IPSec

RPC Encryption

Point to Point Security

Choosing Between IPSec and SSL

Farming and Load Balancing

Summary

Chapter 5 Intranet Security

ASP.NET to SQL Server

ASP.NET to Enterprise Services to SQL Server

ASP.NET to Web Services to SQL Server

ASP.NET to Remoting to SQL Server

Flowing the Original Caller to the Database

Summary

Chapter 6 Extranet Security

Exposing a Web Service

Exposing a Web Application

Summary

Chapter 7 Internet Security

ASP.NET to SQL Server

ASP.NET to Remote Enterprise Services to SQL Server

Summary

Chapter 8 ASP.NET Security

ASP.NET Security Architecture

Authentication and Authorization Strategies

Configuring Security

Programming Security

Windows Authentication

Forms Authentication

Passport Authentication

Custom Authentication

Process Identity for ASP.NET

Impersonation

Accessing System Resources

Accessing COM Objects

Accessing Network Resources

Secure Communication

Storing Secrets

Securing Session and View State

Web Farm Considerations

Summary

Chapter 9 Enterprise Services Security

Security Architecture

Configuring Security

Programming Security

Choosing a Process Identity

Accessing Network Resources

Flowing the Original Caller

RPC Encryption

Building Serviced Components

DCOM and Firewalls

Calling Serviced Components from ASP.NET

Security Concepts

Summary

Chapter 10 Web Services Security

Web Service Security Model

Platform/Transport Security Architecture

Authentication and Authorization Strategies

Configuring Security