Building Secure ASP.NET Applications - People Search Directory

Chapter 1: Introduction 5
Part IV, Reference
This reference part of the guide contains supplementary information to help further
your understanding of the techniques, strategies, and security solutions presented
in earlier chapters. Detailed How Tos provide step-by-step procedures that enable
you to implement specific security solutions. It contains the following information:
● Chapter 13, “Troubleshooting Security”
●
●
●
●
●
●
●
●
●
“How Tos”
“Base Configuration”
“Configuration Stores and Tools”
“How Does It Work?”
“ASP.NET Identity Matrix”
“Cryptography and Certificates”
“ASP.NET Security Model”
“Reference Hub”
“Glossary”
Key Terminology
This section introduces some key security terminology used throughout the guide.
Although a full glossary of terminology is provided within the “Reference” section
of this guide, make sure you are very familiar with the following terms:
● Authentication. Positively identifying the clients of your application; clients
might include end-users, services, processes or computers.
● Authorization. Defining what authenticated clients are allowed to see and do
within the application.
● Secure Communications. Ensuring that messages remain private and unaltered
as they cross networks.
● Impersonation. This is the technique used by a server application to access
resources on behalf of a client. The client’s security context is used for access
checks performed by the server.
● Delegation. An extended form of impersonation that allows a server process
that is performing work on behalf of a client, to access resources on a remote
computer. This capability is natively provided by Kerberos on Microsoft®
Windows® 2000 and later operating systems. Conventional impersonation (for
example, that provided by NTLM) allows only a single network hop. When
NTLM impersonation is used, the one hop is used between the client and server
computers, restricting the server to local resource access while impersonating.