If we want to make an application that works between several systems we have several options, any communication between the client and the application must first go through a Web server (IIS, for example), and as a second step we can make any process that runs on a Windows server do so as users of a system account or a DB.

The elements that control an authorization in ASP.NET are:

  • Windows Access Control Lists (ACL)
  • Web server permissions
  • URL Authorization
  • .NET Main Objects
  • Method and function level security

In this article we want to highlight those related to objects:  

WindowsMain object

This object is used when we want to authenticate the user accounts of a Windows system through IIS, thus adjusting to the permissions that said user has on said machine. Or directly be able to authenticate all users of a certain domain without having to create new accounts or when making an application for an intranet.

 WindowsIdentity MyIdentity = WindowsIdentity.GetCurrent();
 WindowsPrincipal MyPrincipal = new WindowsPrincipal(MyIdentity);

GenericPrincipal Object

It is the way to authenticate users when we have the data within our own database, and we want to use our private classes. You can work on the main object of the OnAuthenticate event.  To know which users are authenticated, you can use a cookie.

GenericIdentity MyIdentity = new GenericIdentity("MyUser");
String[] MyStringArray = {"Manager", "Teller"};
GenericPrincipal MyPrincipal = new GenericPrincipal(MyIdentity, MyStringArray);
Thread.CurrentPrincipal = MyPrincipal; 

P.S. The code has been obtained from the great .NET library (MSDN) never forget to visit it.