Windows authentication in asp

Best practices

[Jayme Richards]

I'm new to asp and to all web design and have run into a stumbling block.

I am trying to create a page with both anonymous access and NTFS permissions for certain pages.
The problem I am running into is with Frontpage I believe. I am using a hyperlink toolbar with
active graphics, and anytime I mouse over the link it brings up the windows authentication.

I think I can create a standard hyperlink to a login page, set the NT permissions on that page, and then
have that page direct me to another page (or back to the original page).

Here's my question: Running windows 2000 server, is there a way to use a conditional statement
using a windows security group as a condition (ie, is user member of...)that I can cause toolbars
or code to not be present or visible. An example would be a link that is not present if the user
is not part of the 'administrators' group.

If I'm barking up the wrong tree, a turn in the right direction would be most helpful.

[sharbel]

Do yourself a favor and go straight to ASP.NET instead of ASP.. Security programming, Roles based authentication etc is a breeze in .NET

[Xoc]

This Visual Basic function should work:

Public Function IsMember(ByVal strServerName As String, _ 
ByVal strGroupName As String, _ 
ByVal strMember As String) As Boolean 
 Dim grp As Object 
 Set grp = GetObject("WinNT://" & strServerName & "/" & strGroup & ",group") 
 IsMember = grp.IsMember("WinNT://" & strServerName & "/" & strMember) 
End Function 

Unfortunately, you need to put that into a Visual Basic DLL and install it on the server for it to work.

You can then use it by doing something like this in your asp code, assuming that the DLL Library Name is Xoc and the class the function is in is Security:

<% 
Function IsMember(strServerName, strGroupName, strMember) 
dim security 
Set security = Server.CreateObject("Xoc.Security") 
IsMember = security.IsMember(strServerName, strGroupName, strMember) 
End Function 
%> 
<% 
If IsMember("MyServer", "Administrators", "Administrator") Then 
Call Response.Write("<a href=""adminfunction.asp"">Admin Function</a>") 
End If 
%> 

[Jayme Richards]

I've not used ASP.NET, to use that I just load the .NET framework available from Microsoft?

Will that limit the clients to only people who have loaded the .NET framework, or will the server side handle the new requests when it compiles the ASP?

[edicius]

Essentially you really only need to install the .NET Framework on your web servers and development workstations - though you'll probably also want to get either Visual Studio .NET, or another .NET development environment (I had to start my work with ASP.NET in notepad back in the day.... what a pain.).

Two mature, very usable, and FREE products to check out are #Develop (http://www.icsharpcode.net/OpenSource/SD/default.asp) and Web Matrix (http://www.asp.net/webmatrix/). I've been playing around with #Develop for the past few months, and would probably go with it over Web Matrix at this point. If you can afford it/are running an Windows box, Visual Studio .NET buys you more development power and a number of time savers (plus - a majority of the example code tends to focus more around it).

In regards to your concerns on clients without the .NET Framework - think of it as similar to ASP. In basic terms, you write a bunch of server-side code and all the user receives is the HTML/JavaScript once the ASP code is executed by the server. ASP.NET is very similar in this regard.

The only time a client would need the .NET Framework would be if you deploy an application that would be executing at least partly on their system (I don't mean client script). You do have facilities within the Framework to do 'Winforms' applications over the web (popularly coined as 'No-Touch Deployment'), but this is essentially writing a full-fledged desktop application, rather than a web application.

So basically - if you're medium is ASP.NET; no - your clients do not need the .NET Framework to view your pages.