ASP+ works in conjunction with IIS to support authentication using <b>Basic</b>, <b>Digest</b>, and <b>Windows</b> authentication. ASP+ supports the Microsoft <b>Passport</b> authentication service, which provides single sign-on services and support for user profiles services.
<p>
In addition, ASP+ provides a robust service for applications that want to use forms-based authentication. This authentication service uses cookies to authenticate users and allows the application to do its own credential verification.
<p>
It's important to realize that ASP+ authentication services are subject to the authentication services provided by IIS. For example, in order to use Basic authentication in an IIS application, one must configure the use of Basic authentication for the application using the Internet Service Manager tool.
<p>
ASP+ provides two types of authorization services: checks against ACLs or permissions on a resource that determine whether the authenticated user account can access the resources, and URL authorization, which authorizes an identity for pieces of the web space. To illustrate the difference, consider the following scenario. An application is configured to allow anonymous access using the IUSR_MYMACHINE account. When a request for an ASP+ page (e.g. "/default.aspx") is authorized, a check is done against the ACLs on that file (e.g. "c:\inetpub\wwwroot\default.aspx") to see whether or not the IUSR_MYMACHINE account has permission to read the file. If it does, then access is authorized. File authorization, as this is called, is performed automatically.
<p>
Now for URL authorization, in this case, the anonymous user is checked against the configuration data computed for the ASP+ application. If access is allow for the requested URL, the request is authorized. In this case, ASP+ checks to see if the anonymous user has access to /default.aspx (that is, the check is done against the URL itself, not against the file that the URL ultimately resolves to).
<p>
This might seem a subtle distinction, but it allows applications to use authentication schemes likes forms-based authentication or Passport authentication, where the users do not correspond to a machine or domain account. It also allows for authorization against virtualized resources, where there is no physical file underlying the resource. For example, an application could choose to map all requests for files ending in .STK to a handler that served stock quotes based on variables present in the query string. In this case, there is no physical .STK to do ACL checks against, so URL authorization is used to control access to the virtual resource.
<p>
As mentioned above, file authorization is always performed against the authenticated account provided by IIS. If anonymous access is allowed, this will be the configured anonymous account. Otherwise, it will an NT account. This might sound more confusing than it is--this is what ASP users are already used to and works in exactly the same way as ASP does today.
<p>
File ACLs are set for a given file or directory using the Security tab in the Explorer property page. URL authorization is configured as part of an ASP+ application and is described fully in <a href="/quickstart/aspplus/doc/authorization.aspx">Authorizing Users and Roles</a>.
<p>
To activate an ASP+ authentication service, one must configure the <authentication> element in the <security> section of the application's configuration file. This element can have one of the following values:
<tr><td>None</td><td>No ASP+ authentication services are active. Note that IIS authentication services may still be present</td></tr>
<tr><td>Windows</td><td>ASP+ authentication services attach a WindowsPrincipal (System.Security.Principal.WindowsPrincipal) to the current request that allows for authorization against NT users/groups</td></tr>
<tr><td>Cookie</td><td>ASP+ authentication services manage cookies and redirect unathenticated users to a login page. This is often used in conjunction with the IIS option to allow anonymous access to an application.</td></tr>
<tr><td>Passport</td><td>ASP+ authentication services provide a convenient wrapper around the services provided by the Passport SDK, which must be installed on the machine</td></tr>
</table>
<p>
As an example, the following configuration file enables forms-based (cookie) authentication for an application.
