Improving Web Application Security: Threats and - CGISecurity

Chapter 11: Building Secure Serviced Components 307You can specify the impersonation level for a serviced component, which applieswhen the service component is a client, using the following attribute:[assembly: ApplicationAccessControl(ImpersonationLevel=ImpersonationLevelOption.Identify)]Note Using this attribute is equivalent to setting the Impersonation Level value on the Securitypage of the application’s Properties dialog within Component Services.The following table describes the effect of each of these impersonation levels:Table 11.1 Impersonation LevelsImpersonation Level DescriptionAnonymousThe server cannot identify the client.IdentifyImpersonateDelegateThis allows the server to identify the client and perform access checksusing the client’s access tokenThis allows the server to gain access to local resources using the client’scredentialsThis allows the server to access remote resources using the client’scredentials (this requires Kerberos and specific account configuration)For more information, see the “Impersonation” section in Chapter 17, “Securing YourApplication Server” and “How to Enable Kerberos Delegation in Windows 2000” inthe References section of MSDN article, “Building Secure ASP.NET Applications,” athttp://msdn.microsoft.com/library/en-us/dnnetsec/html/secnetlpMSDN.asp.Sensitive DataIf your application transmits sensitive data to and from a serviced component acrossa network to address the network eavesdropping threat, the data should beencrypted to ensure it remains private and unaltered. You can use transport levelprotection with IPSec or you can use application level protection by configuring yourEnterprise Services application to use the RPC packet privacy authentication level.This encrypts each packet of data sent to and from the serviced component to provideprivacy and integrity.You can configure packet privacy authentication using the Component Services toolor by adding the following attribute to your serviced component assembly:[assembly: ApplicationAccessControl(Authentication = AuthenticationOption.Privacy)]