First, I am new to Web app programming. I come from Desktop apps (WinForms & WPF).
Recently I have been assigned a project that was made in the past by ohter people. This project is done in ASP.NET MVC and it uses an InProc session state mode.
Now, I want to build a web gardening, that is, use multiple worker process for the application pool. I have googled and I have discovered that InProc session does not work with web gardening because each worker process within app pool uses its own session state. So I am planning to switch it into another session state mode such as State Server or SQL Server.
Now I have a doubt. Apart from changing session state mode in Web.config:
<configuration>
<system.web>
<sessionState mode="InProc" timeout="25"></sessionState>
</system.web>
</configuration>
... Do I need to do some extra work? for example reprogramming the ASP.NET MVC app, configuration or some other things in order it to work?
Below I share some interesting links:
Configuring Server and SQL Server State
HOW TO: Configure SQL Server to Store ASP.NET Session State
For web farms you should keep your session either in StateServer or Sql Server.
To do so you need to add following configuration
<connectionStrings>
<add name="ConnectionString1"
connectionString="Data Source=YourServer;Initial
Catalog=SessionDatabase;Integrated Security=True"
providerName="System.Data.SqlClient" />
</connectionStrings>
<!--Change your <sessionState mode="InProc" timeout="25"></sessionState> to this.-->
<sessionState mode="SQLServer" customProvider="DefaultSessionProvider">
<providers>
<add name="DefaultSessionProvider" type="System.Web.Providers.DefaultSessionStateProvider, System.Web.Providers, Version=1.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" connectionStringName="ConnectionString1" />
</providers>
Same question was asked here but it was not a solution for me, its been more than 16 hours I'm trying to find solution for it.
I setup Windows Authentication for my MVC5 (ASP.Net Fw4.5) application using VS2013 (Windows Server 2012 R2) following are the major steps i did for setting up.
I have two controllers I put Authorize attribute on Home controller, About controller does not have any attribute on it
On project properties Enabled Windows Authentication
Web.Config as below
<authentication mode="Windows" />
<authorization>
<allow users="?" />
</authorization>
<identity impersonate="false" />
<roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider">
<providers>
<clear />
<add name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider" applicationName="/" />
</providers>
</roleManager>
<validation validateIntegratedModeConfiguration="false" />
IIS Settings
Anonymous Authentication is Enabled
Windows Authentication is Enabled (Provider: NTLM, Negotiate)
With these configurations my application works perfect on IISExpress, but when I access it through IIS it prompts for login/password upon giving correct username/password it keep repeating. (I can access About Controller without Authorize attribute)
I inspected request through Fiddler that bring something interesting. Below is the response when i access through IIS
When i access through IISExpress i can see there are three entries for single request two of them get 401 but third gets 200
I'm running a MVC4 website on windows azure. I've created a worker role to perform scheduled tasks. One of these tasks requires deleting user who have not confirmed their registration for a long time. I need to use SimpleMembershipProvider in my worker but I can't configure it. I get exceptions roleManager feature is not enabled. I've tried adding the following to my app.config (found somewhere on the internet, can't find any documentation for it):
<system.web>
<roleManager enabled="true" defaultProvider="WebConfigRoleProvider">
<providers>
<add name="WebConfigRoleProvider" type="WebConfigRoleProvider.Core.WebConfigRoleProvider"/>
</providers>
</roleManager>
</system.web>
and now I get errors about WebConfigRoleProvider missing from some assembly.
Please help...
First post here on stackoverflow but I love the site!...
I've successfully created a fully functioning Azure hybrid model application using MVC 4. Published and works great. Now I want to add ACS for auth to my site. I've followed all the steps but when I run the app in simulation it fails to re-direct to ACS and offers up the page stating that it couldn't find login.aspx.
I have created a simple website solution just to prove that my ACS is setup correctly and it works just fine. I noticed that the web.config files of the two solutions were wildly different.
Anyone tried to do this yet? Any help would be appreciated.
--------- Solution -----------
I finally got everything to work. The key was to remove the WebMatrix.WebData references since I didn't need to do my own auth. The following came from MVC4 Release notes.
When WebMatrix.WebData.dll is included in in the /bin directory of an ASP.NET MVC 4 apps, it takes over the URL for forms authentication. Adding the WebMatrix.WebData.dll assembly to your application (for example, by selecting "ASP.NET Web Pages with Razor Syntax" when using the Add Deployable Dependencies dialog) will override the authentication login redirect to /account/logon rather than /account/login as expected by the default ASP.NET MVC Account Controller.
Open your web.config file.
Locate the Authentication node.
Change it from:
<authentication mode="Forms" />
To:
<authentication mode="None" />
Comment here, if it doesn't help, and what is the result after changes to web.config.
As a side question - how did you add reference to the ACS namespace - via "right click -> Add STS Reference", or manually changed the web.config ?
Make sure that the required Modules are registered with the web server:
<system.webServer>
<modules runAllManagedModulesForAllRequests="true">
<add name="ClaimsPrincipalHttpModule" type="Microsoft.IdentityModel.Web.ClaimsPrincipalHttpModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler" />
<add name="WSFederationAuthenticationModule" type="Microsoft.IdentityModel.Web.WSFederationAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler" />
<add name="SessionAuthenticationModule" type="Microsoft.IdentityModel.Web.SessionAuthenticationModule, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" preCondition="managedHandler" />
</modules>
...
</system.webServer>
Also make sure that you have microsoft.identityModel section, and you have federatedAuthentcation node within it:
<federatedAuthentication>
<wsFederation passiveRedirectEnabled="true" issuer="https://[your_namespace].accesscontrol.windows.net/v2/wsfederation"
realm="http://127.0.0.1:81/" requireHttps="false" />
<cookieHandler requireSsl="false" />
</federatedAuthentication>
Where "realm" shall be valid URL for Realying Party Application. And requireHttps="false" is to simplify development process.
When you debug it locally, make sure you are running the Cloud project (which uses IIS), and not the Web Project (which will use Cassini / webdevserver, which does not understand the system.webServer section!)
On the first run of my mvc "hello world", i get a couple of buttons; home, about and log on. If I create a user account on the log on, where is the data stored? Is it secure enough to just leave it as is when the time comes to develop my application or should this be going to a database (if it isn't already)?
Thanks for your time.
ASP.Net MVC and WebForms share many of the same components including membership storage, authentication, authorization. These components are used on thousands of public sites around the internet.
Membership
The default ASP.Net MVC template uses the same SqlMembershipProvider as WebForms to store membership information. If you look in the web.config file you'll see the configuration section under the <membership/> element, it'll look like this;
<membership>
<providers>
<clear/>
<add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="ApplicationServices"
enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false"
maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10"
applicationName="/" />
</providers>
</membership>
It references the connection string named ApplicationServices which you'll find defined at the top of the config file:
<connectionStrings>
<add name="ApplicationServices"
connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true"
providerName="System.Data.SqlClient" />
</connectionStrings>
This mounts the aspnet.mdf file found in your application's App_Data directory using a locally installed instance of Microsoft Sql Server Express.
You can easily upsize this to full SQL Server by copying the MDB file to your SQL Server, mounting it, and updating the connection string.
Authentication
Authentication is again handled by the same FormsAuthentication class used for WebForms, it is also configured in the web config file:
<authentication mode="Forms">
<forms loginUrl="~/Account/LogOn" timeout="2880" />
</authentication>
Authorization
The default template also has configuration entries for SqlRoleProvider, and WindowsTokenRoleProvider which can be used to store and retrieve roles for your users from the database or ActiveDirectory respectively. Role managers are configured in the <roleManager/> element.
<roleManager enabled="false">
<providers>
<clear/>
<add name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider" connectionStringName="ApplicationServices" applicationName="/" />
<add name="AspNetWindowsTokenRoleProvider" type="System.Web.Security.WindowsTokenRoleProvider" applicationName="/" />
</providers>
</roleManager>
Roles are by default disabled, you can enable support for roles by changing the enabled attribute of the roleManager element from false to true.
Once you have roles configured, you can use ASP.Net authorization elements to control access to resources on your site. You can also use Authorize attributes on your controllers and/or actions for more finely grained access control. You don't have to use roles for authorization, usernames work just fine, but doing so will make management of authorization much easier.
Security
All of these modules are written using industry accepted security best practices. Authentication is handled by IIS, which can use Digest or Windows Integrated auth, both secure methods; because of browser support, anything you wrote yourself would be restricted to these methods as well.
The passwords are stored hashed in the database with a salt making brute-force attacks with methods such as rainbow tables much more difficult. The providers also support password complexity, and expiration out-of-the-box.
The authentication tokens are securely encrypted with a machine specific key and signed with a MAC to ensure that they haven't been tampered with, only then are they stored in a client-side cookie.
Testability
Even though the security is quite standard, one emphasis that MVC proponents encourage which these components don't make simple, is testing. This issue however can be worked around fairly simply with some strategically placed interfaces, a couple facade classes, and some dependency injection (which is supported by default in MVC3 now).
Yes, it's stored in a database. The database is in the App_Code folder under the name of ASPNETDB.MDF. You can configure it at your web.config file.
Is it secure? Well, IMHO, it is. But I really don't like this approach, I prefer to design my own authentication service and have full control over it. If you're going to stick with this method, you should read more about ASP.NET Membership Provider with Forms Authentication.
I'm taking the answer to the next logical step: OK, so I know it is in ASPNETDB.MDF, so how can I browse the table?
(at least it was my next logical question)
Here is a good link: http://learningsqlserver.wordpress.com/2011/02/13/how-can-i-open-mdf-and-ldf-files-in-sql-server-attach-tutorial-troublshooting/
Essentially:
Run SQL Server Management Studio (menu shortcut under "Microsoft SQL
Server ####")
Connect Object Explorer to your SQLEXPRESS server
Right-click on Databases and choose Attach...
Browse to your MDF file
If you create a default ASP.NET MVC 3 app and look int the the web.config, you'll see:
<add name="ApplicationServices"
connectionString="data source=.\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true"
providerName="System.Data.SqlClient" />
And
<membership>
<providers>
<clear/>
<add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="ApplicationServices"
enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="false"
maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10"
applicationName="/" />
</providers>
</membership>
This appears to attempt to connect to a local SQL Server Express instance and load aspnetdb.mdf from the app data folder. The membership.providers key then references System.Web.Security.SqlMembershipProvider, and references the ApplicationServices connection.
the database is created aoutomatically by asp.net. this feature uses asp.net build in membership feature. you shoul look at it firstly : http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx
and also look at the models folder, you will see the account model there. and look at the controller folder. there, you will accountcontroller. review the code and you will figure it out.