CODEWITHSUNDEEP
asp.netasp.net-mvcsecuritypermissions
Duncan Gravill
Duncan Gravill

Reputation: 4672

asp.net user permissions

I am quite confused about this and none of the texts / docs / SO questions have elucidated the matter for me.

I want my asp.net MVC app to be able to save an XML doc to a folder on the server. But I am getting an exception...

Access to the path 'D:\blah\blah\folder\xml_data.xml' is denied.

So as I understand it my application is running under a user account that does not have write permissions.

I think I had this problem before and my solution was to contact my web host and ask them to give my site permissions.

But what if I want to create my own custom set of roles with corressponding permissions? Do these have to be added into IIS? Would I have to create a list and then hand it over the the web host? What would such a list look like? As I understand it, it is not possible to configure roles and permissions in web.config, is that correct?

Once I have the roles and their permissions set up how to I set the default role for the app to run under and also how do I programitically change the role that the app is running under?

ps. I don't want to use asp.net membership I would like to know how to set this up myself.

Upvotes: 0

Views: 3073

Answers (1)

Erik Funkenbusch
Erik Funkenbusch

Reputation: 93424

Use asp.net membership. I don't care if you don't like it. Use it. It's easy, it's simple, and it gets security right. You will mess security up if you do it yourself and don't know what you're doing.

People give membership a bad rap, it's a good tool. Most people just make the wrong assumptions about it.

You define your roles in the membership/role API. This is stored in your database. You can't have roles without a user to apply them to, so you need a membership system of some type.

EDIT:

There are two kinds of users here. The first is the user that the ASP.NET worker process runs as under IIS. This is the user that your host must define, and allow to access various folders to access files.

The second is the IIdentity user of asp.net, this is the user that asp.net defines for the logged in web user, and this is completely seperate from the Worker process user. IIdentity users have no inherent operating system rights or privileges, other than those assigned to the worker process identity.

In other words, IIDentity based users run as the same Worker process identity in IIS.

The exception to this is when you define "impersonate=true" in the web.config, and this allows the worker process to "log on" to the OS as the user in question. In other words, the worker process will run as the web users credentials. This requires that the web user have credentials in the OS as well.

The other exception is that you can specify a specific OS user to impersonate in the web.config. But, again, there must be an operating system user to impersonate. Also, impersonation is a very expensive operation and takes a lot of system resources.

See http://msdn.microsoft.com/en-us/library/aa292118(v=vs.71).aspx

Upvotes: 1

Related Questions