Authentication and Authorization

Question

Explain in brief what is Authentication and Authorization in web Config file?

Chetan Ranpariya · Answer

Hi Chetan, Following are the generic definitions of Authentication and Authorization. Authentication is the process of validating if the user who is trying to access the applicatiion is a valid user or not. Validating is done by various ways such as asking user to enter username and password or signature verification etc. Authoriazation is the process of verifying if the authenticated user can access certain part/feature/fuctionality of the application. This we do by granting user to the permission or assigning a role to the user and allowing access to specific part/feature/functionality of the applicaton to that role. In Web.config, Authentication is configured by setting type of the authentications such as Forms, Windows or None. Authorization is configed by allowing or denying roles or usernames to access specifc paths or files types in the application. Please go thru the following article which explains this with very good details. https://www.codeproject.com/Articles/98950/ASP-NET-authentication-and-authorization Thanks and regards, Chetan Ranpariya

Khaja Moizuddin · Answer

In Asp.net we have a security concept for checking the valid user who request for the webpage or not ,we have two terminologies used in security concept 1) Authentication : It is a process of Authenticating the user when user requests for the restricted webpage, if the user is a valid user then we will provide the restricted webpage to the user. If the user is a valid user then IIS will be generating with an Ticket. 2) Authorization : It is a process of checking Authorized user or not to access the restricted webpage. IIS will provide you with the restricted webpage who are having the ticket based on type of authentication,like we have three types of authentication ie.Forms Authentication, Passport Authentication, Windows Authentication. Hope this helps you.

Nitin Sontakke · Answer

First, please do not consider that authentication and authorization is specific to web.config. This is a generic concept and is applicable everywhere. When your friend comes to your house, you authenticate that s/he is indeed your friend and let him/her get in your house. But you do not authorize him/her to access your safe/locker. Simple.

Bikesh Srivastava · Answer

Whatever i have done i think best practice for authentication and autherization is OWIN with identity.