Improving Web Application Security: Threats and - CGISecurity

134 Part III: Building Secure Web ApplicationsPrincipals and IdentitiesRole-based security is implemented with Principal and Identity objects. The identityand role membership of the authenticated caller is exposed through a Principalobject, which is attached to the current Web request. You can retrieve the object byusing the HttpContext.Current.User property. If the caller is not required toauthenticate with the application, for example, because the user is browsing apublicly accessible part of the site, the Principal object represents the anonymousInternet user.There are many types of Principal objects and the precise type depends on theauthentication mechanism used by the application. However, all Principal objectsimplement the System.Security.Principal.IPrincipal interface and they all maintain alist of roles of which the user is a member.Principal objects also contain Identity objects, which include the user’s name,together with flags that indicate the authentication type and whether or not the userhas been authenticated. This allows you to distinguish between authenticated andanonymous users. There are different types of Identity objects, depending on theauthentication type, although all implement the System.Security.Principal.IIdentityinterface.The following table shows the range of possible authentication types and thedifferent types of Principal and Identity objects that ASP.NET Web applications use.Table 6.1 Principal and Identity Objects Per Authentication TypeAuthenticationTypePrincipal andIdentity TypeWindows WindowsPrincipal +WindowsIdentityCommentsVerification of credentials is automatic and uses theSecurity Accounts Manager (SAM) or Active Directory.Windows groups are used for roles.Forms GenericPrincipal +FormsIdentityPassport GenericPrincipal +PassportIdentityYou must add code to verify credentials and retrieve rolemembership from a user store.Relies on the Microsoft Passport SDK. PassportIdentityprovides access to the passport authentication ticket.PrincipalPermission ObjectsThe PrincipalPermission object represents the identity and role that the currentprincipal must have to execute code. PrincipalPermission objects can be useddeclaratively or imperatively in code.