Authentication Techniques

Question

Hi
What are various way of Authentication Techniques in Asp.Net. Can you explain how the Asp.Net Authentication process works ?

Satyapriya Nayak · Answer

Hi Arun,
Selecting an authentication provider is as simple as making an entry in the webconfig  file for the application.we can use of these entries to select the corresponding bulit in authetication provider
Windows authetication  : if we select authetication for our ASP.NET application ,we also have to configure authentication with in IIS.This is because Windows authentication .IIS gives you a choice for four authentication methods
Anonymous
Basic
Windows
Digest
If we select Anonymous,IIS does not perform any authentication ,anyone is allowed to access the ASP.Net application
If we select basic authentication ,Users must provide a windows username and password to connect.But the main drawback is ,this information is sent over the network in clear text
If we select digest authetication Users must provide a windows username and password to connect.but this information is hashed before it is sent
If we select windows integrated authentication ,password never cross the network. Users must still have a username and password,but the application uses the Kerboeros or challenge/response protocols  authenticate the user
Passport Authentication : To use the passport authentication we have to download the passport software Development Kit (SDK) and install it in your system.passport authentication is a microsoft's passport service to authenticate the users of our application.if your users have signed up with passport ,and you configure the authentication mode of the application to the passport authetication.Passport uses an encrypted cookie mechanism to indicate autheticated users.
Forms Authetication : Forms authetication provides you with a way to ohandle auhtetication using your own cutom logic with in an ASP.NET application.the following applies if we choose forms authentication
àwhen a user requests apage for the application ,ASPNET checks for the presence  of a special session cookie .if the cookie is present ,ASP.Net assumes the user is authenticated  and process to request
if the cookie isn't present .ASPNET redirects the user to a web form you provide.
Please refer the below links
http://www.c-sharpcorner.com/UploadFile/lmoningi/AuthenticationAndAuthorizatio11252005233533PM/AuthenticationAndAuthorizatio.aspx
http://www.4guysfromrolla.com/articles/031204-1.aspx
http://www.a2zdotnet.com/View.aspx?Id=13
Thanks

Senthilkumar · Answer

Hi Arun,
ASP.NET implements additional authentication schemes using authentication providers, which are separate from and apply only after the IIS authentication schemes. ASP.NET supports the following authentication providers:
Windows (default) Forms Passport None To enable an authentication provider for an ASP.NET application, use the authentication element in either machine.config or Web.config as follows:
Each ASP.NET authentication provider supports an OnAuthenticate event that occurs during the authentication process, which you can use to implement a custom authorization scheme. The primary purpose of this event is to attach a custom object that implements the IPrincipal Interface to the context.
Which ASP.NET authentication provider you use typically depends upon which IIS authentication scheme you choose. If you are using any of the IIS authentication schemes other than Anonymous, you will likely use the Windows authentication provider. Otherwise, you will use Forms, Passport, or None.
Fore detailed information: http://msdn.microsoft.com/en-us/library/aa291347(v=vs.71).aspx
http://www.codeproject.com/Articles/98950/ASP-NET-authentication-and-authorization