Windows Web Solutions UPDATE, October 7, 2003

Windows Web Solutions UPDATE—brought to you by the Windows & .NET Magazine Network

http://www.winnetmag.com

This Issue Sponsored By

HostMySite.com

http://www.HostMySite.com/windot

Windows & .NET Magazine Network

http://www.winnetmag.com

October 7, 2003--In this issue:

1. Commentary: Role-Based Access with Authorization Manager

2. Keeping Up with IIS

3. Announcements

4. Resource

5. Event

6. New and Improved

7. Contact Us

Sponsor: HostMySite.com

HostMySite.com is a provider of quality, customer focused, web hosting. Our high-tech data-center has multiple DS-3 Internet connections, generator, and UPS backups, and is the ideal place to host your website or dedicated server. Our 24/7/365 support staff is trained in both Windows, and Linux, and can assist you with all of your requirements. Our plans are backed by an aggressive 99.9% uptime guarantee, and start as low as $8.95 per month for shared hosting, or $129.00 per month for dedicated servers. Ask us about our E-commerce packages, or ColdFusion and SQL Server plans as well. We are always here, and happy to help. Call us at 1-877-215-HOST, or visit

http://www.HostMySite.com/windot

1. Commentary: Role-Based Access with Authorization Manager

Tim Huckaby, [email protected]

In the broad spectrum of security, authentication and authorization are often grouped together, but they differ greatly. Authentication answers the question "Who is this user?" Authorization answers the question "What can this user do?"

Because authentication and authorization differ, you achieve them in different ways. Achieving authentication is easy if you follow a few best practices. One of those best practices is to use the Windows Server OS for authentication when possible. The OS takes care of many authentication details, and the platform stores the users' credentials. For example, you can use Windows Server 2003's Active Directory (AD) to authenticate Microsoft IIS users.

In contrast, authorization was historically tough to achieve because you had to use custom-built applications. However, Windows 2003 has changed that situation by providing a feature called Authorization Manager. Combined with Windows .NET Framework's role-based security, Authorization Manager is a powerful tool.

Since Windows NT 4.0, administrators were able to secure OS resources (e.g., file-system objects) with ACLs. In the ACL approach, you can attach discretionary ACLs (DACLs) to a persistent object and call the AccessCheck API to make access decisions. The API looks at a user's group memberships and compares them against the ACL's contents to determine whether the user has the necessary access rights.

Applications that don't have well-defined persistent objects have no place to put an ACL, so the ACL approach can be difficult, if not impossible, to apply in these applications. Line of business (LOB) applications often fall into this category. Fortunately, Authorization Manager provides an authorization framework that you can use when you need to give users access to an LOB application. Instead of determining whether to grant access based on ACLs, Authorization Manager determines whether to grant access based on "roles" that you assign. A role is an object to which you assign access permissions to certain resources. You can think of a role as a job position; you assign a position the rights to access any resource it needs. You then assign users to appropriate roles.

Authorization Manager consists of a set of COM-based runtime interfaces and the Microsoft Management Console (MMC) Authorization Manager snap-in. Applications written in ASP.NET use the Authorization Manager API through the interop assembly that ships in the AuthMan directory in the Framework.

You can integrate Authorization Manager with Internet Information Services (IIS) 6.0 to implement IIS 6.0 URL authorization, which lets you authorize users' access to URLs in a Web application. When a client requests a URL, IIS 6.0 URL authorization validates a user's access based on that user's specified role. You control access to URLs by using custom roles, Lightweight Directory Access Protocol (LDAP) queries, and dynamic business rules (BizRules). BizRules let you take runtime data into account.

Although Authorization Manager was a barely known feature at first, it's starting to gain popularity as people discover its power. According to Microsoft, Authorization Manager's goals are to simplify application access-control administration, provide a simplified and natural application-development model, and enable flexible and dynamic authorization decisions. Authorization Manager meets those goals. The bottom line is that Authorization Manager provides role-based authorization security that's not only part of the platform but also easy to use. You can find more information about Authorization Manager at the following four sites:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/maintain/security/athmanwp.asp

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetserv/html/azmandynamgrps.asp

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetserv/html/azmanroles.asp

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetserv/html/azmanbizrules.asp

Sponsor: Windows & .NET Magazine Network

If You Like This Email Newsletter...

Then be sure to check out the Windows & .NET Magazine Network. You'll find page after page of problem-solving, time-saving articles plus other fantastic resources like our forums, Windows IT library, Download Central, and much, much more. Click here now!

http://www.winnetmag.com

2. Keeping Up with IIS

http://www.winnetmag.com/articles/index.cfm?articleid=37944

3. Announcements
(brought to you by Windows & .NET Magazine and its partners)

http://www.aelita.com/100703websolutions

http://www.winscriptingsolutions.com/rd.cfm?code=fsep26xxup

4. Resource

http://www.winnetmag.com/forums/rd.cfm?cid=41&tid=63986

5. Event
(brought to you by Windows & .NET Magazine)

http://www.winnetmag.com/roadshows/wireless

6. New and Improved

[email protected]

Sponsored Links

CrossTec
Free Download - NEW NetOp 7.6 - faster, more secure, remote support

http://ad.doubleclick.net/clk;5930423;8214395;j?http://www.crossteccorp.com/tryit/w2k.html

Microsoft
Attend a Microsoft(R) Office System Launch Event -- Get a FREE Eval Kit

http://ad.doubleclick.net/clk;6233617;8214395;l?http://click.atdmt.com/DDB/go/msg02800036ddb/direct/01/

7. Contact Us