Access Control List in .NET FrameworkOnce you complete developing a web application, you need to secure it. This is when the aspect of security comes into picture. There will be some portions of your application which need to be secured from users. Securing an application may need extra hardware to build complex multi-layer systems with firewalls, and also some highly secure features. Security enables you to provide access to a specified user after the user is authenticated and authorized to access the resources in your web application. The Access Control List is used in the authorization process.
The basic concepts of security are Authentication, Authorization, Impersonation and Data or functional security. Authentication is the process that enables to identify a user, so that only that user is provided access to the resources. Authorization is the process that enables to determine whether a particular user can be given access to the resources that the user requests. Impersonation is the process that provides access to resources requested by a user under a different identity. Data or functional security is the process of securing a system physically, updating the operating system and using robust software. Some elements of an operating system, the Internet Information Server (IIS), and the .NET Framework work in coordination to provide the features required to execute the security concepts mentioned above. For example, Windows 2000 uses its own list of user accounts for identifying and authenticating users. IIS identifies the users based on the information provided by Windows, when the users access a web site. IIS after identification of the users, passes this information to ASP.NET. Then the user information is checked for authorization. To restrict access to the users for certain resources of an application, a process of identifying the users becomes a necessity. Authentication enables to restrict a user to access the resources by certain ways. It could be a combination of a username and password, a digital certificate, a smart card or a fingerprint reader. The validity of the information provided by the user helps identify the user, so that the user is provided access to the requested resources. The process of successful identification of the user implies that the user is authenticated. After identification of the user is over, the next step is to determine whether the authenticated user has access to the resources. The process of determining the access to the resources for a particular user is known as Authorization. In Windows based systems, resources have an Access Control List, which provides a list of users who have access to that resource. The list also specifies the kind of access such as read, write, modify, and delete the resource, for each user. For example, if a user requests an ASP page, the operating system checks whether the user has Read access to the page and if the user has read permission, then the operating system allows the IIS to fetch the page. The IIS has authorization settings which enable the IIS to control the access of resources by users. File Access Control Lists are set for a given file or directory using the Security tab in the Explorer property page.
|