.NET FISHER

*** Problem Description ***
Customer wanted to implement ASP.NET forms authentication across his entire
web app
which consisted of ASP.NET *and* classic ASP content.

<><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><>
<>
*** Resolution ***

The following sample should work.  A few notes though:  This would have
been pretty
easy using simple COM Interop to call into the FormsAutentication utility
functions
however the functions require an HttpContext which is only available in an
ASP.NET
application.  As a workaround, we created and ASP.NET web service that does
the
forms auth ticket validation.

1.  First, use the ASP.NET Forms Authentication sample from the following
KB as a
base to start:

Q301240 HOW TO: Implement Forms-Based Authentication in ASP.NET Using C#
<http://support.microsoft.com/default.aspx?scid=kb;EN-US;Q301240>

2.  Next, create a class that will manually validate a ticket that it is
passed,
return the forms authentication cookie name that is in use, and finally
return the
login url (all so that the code can be self-contained with minimum
administration
needed):

////////////// start sample code //////////////

//this method validates a ticket passed from ASP
public bool IsAuthenticated(string rawCookieData)
{
if(rawCookieData.Trim().Length <= 0)
  return false;

FormsAuthenticationTicket decryptedTicket;

try
{
  decryptedTicket = FormsAuthentication.Decrypt(rawCookieData);
}
catch
{
  //log reason for failure or whatever here if you like
  return false;
}

if (decryptedTicket.Expired)
  return false;
  
// Optionally you could change the method signature to return
// the decrypted ticket and then, you can call RenewTicketIfOld
// and then implement code on the ASP side to update the cookie
// with the newed ticket.  This would only be necessary if the
// ticket has a timeout set (this resets the timeout)
// see the MSDN docs on FormsAuthentication.RenewTicketIfOld.
 
return true;

}

// method merely returns the name of the cookie being used
public string GetCookieName()
{
return FormsAuthentication.FormsCookieName.ToString();
}

// method returns the login url used in the redirect
// this is trickier since there is no FormsAuth utility function available
to
return this so we have to manually look at web.config
private string GetLoginURL()
{
string sConfigPath = Server.MapPath(Request.ApplicationPath) +
"\\web.config";

XmlDocument doc = new XmlDocument();
doc.Load(sConfigPath);
  
try
{
  XmlNode xmlNodeForms =
doc.SelectSingleNode("configuration/system.web/authentication/forms");
  return xmlNodeForms.Attributes.GetNamedItem("loginUrl").InnerText;
}
catch
{
  throw new System.Exception("error in GetLoginURL()");
}
}


////////////// end sample //////////////

3.  Now create another .NET wrapper class that calls this web service (or
create
and compile a webproxy class)
4.  Next, use regasm.exe and gacutil.exe to make this "wrapper" class
callable from
ASP via ComInterop.
5.  The ASP code would look something like this:

Set oAuthClass = Server.CreateObject("ASPNETFormsAuth.WrapperClass")
If Not
oAuthClass.IsAuthenticated(Request.Cookies(oAuthClass.GetCookieName)) Then
     Response.Redirect("http://servername/ASPApplicationRoot/" &
oAuthClass.GetLoginURL & "?RetrunURL=" & Requset.ServerVariables("URL"))
End If

This code can be in a standalone ASP page and then can be #included at the
top of every page in the ASP app

A useful actical for web part development basic

http://www.devx.com/dotnet/Article/17518/0/page/1

sharepoint security

http://www.15seconds.com/issue/040511.htm

object model security

In a comment to my post here, Jim asked why he can't access the WSS object model in his code, even though it's running under the Sharepoint context. Since a month has passed and I can't re-enable comments on that post, I'll just answer here:

By default, the security settings for a Sharepoint site is set to WS_Minimal - a predefined set of security policies that can be found in C:\Program Files\Common Files\Microsoft Shared\web server extensions\60\CONFIG\wss_minimaltrust.config. You can change this to WSS_Medium to get a slightly higher security policy (that allows Object Model access, for one thing) or create your own set of security policies for exact customization. Check out the web.config settings in the SPS root directory to see how to define another ruleset, and use the existing .config files as a base

* if want to use object model in managed path (Excluded path).
have to add a web.config with line <trust level="Full" originUrl="" /> or other levels.


SPS customization

http://weblogs.asp.net/bsimser/articles/spscustomization.aspx

http://www.skillart.com/blog/

Running an application command line with different credentials

runas /user:Administrator program.exe

Enabling ASP.NET to run as another user on Windows XP Professional

As an Administrator, edit the attributes of the file"%INSTALLROOT%\Config\machine.config" 'on the processModel tag, as shown:

<processModel
                enable="true"
                userName="DOMAIN\username"
                password="MyPswd2"
                ...
/ >