Question

What is authentication and authorization in ASP.NET?

Answer 1

• Authentication: Prove genuineness
• Authorization: process of granting approval or permission on resources.

In ASP.NET authentication means to identify the user or in other words it's nothing but validating that he exists in your database and he is the proper user.

Authorization means does he have access to a particular resource on the IIS website. A resource can be an ASP.NET web page, media files (MP4, GIF, JPEG etc), compressed file (ZIP, RAR) etc.


 

Types of authentication and authorization in ASP.NET

There are three ways of doing authentication and authorization in ASP.NET:

 

Windows authentication

 

In this methodology ASP.NET web pages will use local windows users and groups to authenticate and authorize resources.

 

Forms Authentication

 

This is a cookie based authentication where username and password are stored on client machines as cookie files or they are sent through URL for every request. Form-based authentication presents the user with an HTML-based Web page that prompts the user for credentials.

 

Passport authentication

 

Passport authentication is based on the passport website provided by the Microsoft .So when user logins with credentials it will be reached to the passport website ( i.e. hotmail,devhood,windows live etc) where authentication will happen. If Authentication is successful it will return a token to your website.

 

Anonymous access

 

If you do not want any kind of authentication then you will go for Anonymous access.

In 'web.config' file set the authentication mode to 'Windows' as shown in the below code snippets.

1. <authentication mode="Windows"/>   

We also need to ensure that all users are denied except authorized users. The below code snippet inside the authorization tag that all users are denied. '?' indicates any unknown user.

1. <authorization>  
2.    <deny users="?"/>  
3. </authorization>