All geek questions in one place

Using Active Directory to authenticate users on a WWW site

I am looking for a new web application that should be safe (if not for any other reason, at some point we will need PCI (Payment Card Industry) accreditation).

From previous experience working with PCI (in the domain), the preferred method is to use integrated Windows authentication, which is then completely transferred through the application to the database using kerberos (therefore, the NT user has permissions in the database). This allows you to improve auditing, as well as permissions at the facility level (i.e., the end user cannot read the credit card table).

There are advantages in that even if someone compromises the web server, they will not be able to get any additional information from the database. In addition, the web server does not store any database credentials (besides, perhaps, a simple anonymous user with very few permissions for a simple website configuration)

So now I'm watching a new web application that will be on the public Internet. One suggestion is to have an Active Directory server and create Windows accounts for each user on the site. These users will then be placed in the appropriate NT groups to determine what permissions they should have (and which pages they can get).

ASP.Net already provides an AD membership provider and a role provider, so this should be fairly simple to implement.

We have a number of issues: scalability, reliability, etc., and I was wondering if there was anyone with experience with this approach or, better yet, some good reasons why this is needed / don't do it.

Any input is appreciated.

+3
source share
3 answers

ADAM , . , , AD, , , MS , . , , , ADAM - (ADFS) , , . ADAM - . , , ADAM , . , , 40- LDAP/Directory, , .

AD/ADAM IMO. MembershipProviders, SqlMembership, . , (SQL Server, , ) , PII ( ) , , . , , , , , , ..

EDIT:. , .NET , Windows Windows ( , db ). , . , , DPAPI .

. -, . , , . , . Windows SQL Server 2008, SQL. , - , . , , - . , - . SQL Server PCI:

SQL Server 2008 (PCI DSS) 1.2.

+4

AD/AM - Active Directory.

. , AD. . . ASPNET AD.

Windows.

ADFS 2.

AD/AM, . ADFS v2 Microsoft, "-". , , ADFS2 , . , : Google, Yahoo, OpenId, . "" . , - , .

+1

This is not a direct answer, but having an AD user account means that this user requires Windows CAL. Another way would be to issue client certificates for user and map client certificates for AD users in IIS.

You can also consider AzMan with SQL repository available from Windows 2008 or open source netsqlazman .

+1
source

Source: https://habr.com/ru/post/1736786/

More articles:


All Articles