Permission Checker Component

The Permission Checker component creates a PermissionChecker object that uses the password authentication protocols provided in Microsoft® Internet Information Server (IIS) to determine whether a Web user has been granted permissions to read a file.

You can use the Permission Checker component to customize an ASP-based page for different types of users. For example, if a Web page contains hyperlinks, you can use the Permission Checker component to test whether the user has permissions for the target Web pages. If the user does not have the proper permissions, you can then omit or alter the hyperlinks to those pages the user may not access.

Syntax

Set oVar = Server.CreateObject("MSWC.PermissionChecker")

Parameters

oVar: Specifies the name of the PermissionChecker object created by the call to Server.CreateObject.

Registry Entries

None.

Methods

HasAccess

Determines whether the user has permissions to access a specified file.

Examples

The following example uses the HasAccess method to test whether the current user has access to a specified file. Note that you can specify either a physical or virtual path.

<% Set pmck = Server.CreateObject("MSWC.PermissionChecker") %>
 
Physical Path Access = <%= pmck.HasAccess("c:\pages\abc\default.htm") %>
Virtual Path  Access = <%= pmck.HasAccess("/abc/default.htm") %>

Remarks

IIS supports the following three types of password authentication in any combination:

Anonymous
Basic
Windows NT® Challenge/Response (NTLM)

When anonymous password authentication is enabled, all users are initially logged on under the IIS anonymous user account. Because anonymous users all share the same account, the Permissions Checker component cannot authenticate individual users when anonymous access is allowed.

For applications where all users have individual accounts, such as intranet-only Web sites, it is recommended that you disable anonymous authentication so that the Permissions Checker component can authenticate individual users.

For applications where some pages must be available to anonymous users and other pages need to be secure, such as mixed Internet and intranet Web sites, you should enable anonymous authentication and at least one other password authentication method, either NTLM or Basic. Then if you deny anonymous access to a specific page, the server will attempt to authenticate the user by using either NTLM or Basic password authentication.

You can use either of the following two methods to deny anonymous access to a specific page.

Set the Access Control List for the ASP-based file to exclude the anonymous user account.
In the ASP script, check for the anonymous user account (if the LOGON_USER server variable is empty) and set Response.Status to the 401 Unauthorized error message. This will cause IIS to attempt to identify the user by using NTLM or Basic authentication.
This is illustrated in the following example.
```
<% 
If Request("LOGON_USER") = "" Then
    Response.Status = "401 Unauthorized"
End if
%>
 
```

If all the files in your application must be available to anonymous users, the Permission Checker component will not able to distinguish individual user accounts. You can still use it, however, to ensure that the specified Web page exists and test whether the anonymous user account has access permissions for that page.

Note NTLM password authentication is currently supported only by Microsoft Internet Explorer, and may not work over a proxy server. Thus, if users connect to your site with browsers other than Internet Explorer or through a proxy server and your application requires a non-anonymous user context, you must also enable Basic password authentication.

Note This component is not installed with IIS. You can install it from the Microsoft Web site at: http://www.microsoft.com/iis/, or from the CD included with the IIS Resource Kit.