ASP.NET C# Authentication Autorization

Question

I am as a study project developed a website in ASP.net. In my web.config file i have autheticaion mode as windows. and i am using an appsettings connection string to connect to my SQL2005 database. Now i want to know what kind of authentication is this? Is this windows? forms? or anonymous authentication?

I have user table in sql 2005 and my first screen is login page. Obviously this user table has login details like username and password which will be matched to user input.

I dont understand i have read so many post on authorization and authienticaion but please clear me on this. Thanks in advance.

Answer 1

You are currently using Windows authentication. Your Windows username and password is used to authenticate you to asp.net.

A login page writing to a user table would be asp.net forms authentication.

Note that sql server authentication is a totally separate issue. It is up to your code to authenticate against your database. When doing so, the connection string in web.config file can be used.

Answer 2

If you want customize your credentials of string connection in order to access your DataBase, you can use Integrated Security or Trusted_Connection

When the value is true, the current credentials of the Windows account used for authentication.

Nota : in yur case i think that you can use FormsAuthentification (You have Windows Authentification)

Link : http://msdn.microsoft.com/fr-fr/library/system.data.sqlclient.sqlconnection.connectionstring(v=vs.80).aspx

Forms Authentification :

<authentication mode="Forms">
 <forms loginUrl="~/login.aspx">
</forms>
</authentication> 
<authorization>
  <deny users="?" />
</authorization>

After your click

 if (IsAuthenticatedValue) //You can adjust  your condition
  {
      FormsAuthentication.RedirectFromLoginPage (.., ..);
  }
  else
  {
      Console.WriteLine("Invalid credentials. Please try again.");
  }

Link : http://msdn.microsoft.com/fr-fr/library/xdt4thhy(v=vs.80).aspx

Answer 3

In addition to the other answer here:

Once the user is logged in, create a Session and store the fact they are logged in using that such as

Session["LoggedIn"] = true; 
Session["Username"] = username;

Then check if they are logged in using your Code and authorise access to the page using that. So on page load if they logged in continue loading the page, else send them to the login page.

When you want to log the user off simply do Session.Clear();