Integrating LDAP with MySQL Configuration in ASP.NET

Transcription

1 Jisc Embedding Benefits Prgramme P3 Packaging the Placements Prtal Integrating LDAP with MySQL Cnfiguratin in ASP.NET Dcumentatin and cde samples drawn frm experiences encuntered while develping the Placements Prtal P3 First the disclaimer: Managing security in ASP.NET is a huge and cmplex area in its entirety and is beynd the scpe f this dcument. Please refer t as a starting pint fr cnfiguring the applicatin t yur wn requirements. The three elements f ASP.NET security tuched n by this dcument are (1) Authenticatin (2) Authrisatin (3) Rle Management Specific requirements between installatins will bviusly vary but a typical scenari, and the ne in place at the University f Nttingham is t use Active Directry fr user authenticatin and MySQL fr Rle Management. As the P3 Placements app relies (fr the time being at least) n the OPUS mysql database, it makes sense t manage user rles with MySQL rather than use Active Directry fr applicatin-specific rle management. The web.cnfig fllwing entry cnfigures ActiveDirectry as the Membership Prvider which takes care f Authenticatin <membership defaultprvider="aspnetactivedirectrymembershipprvider"> <prviders> <clear/> <add name="aspnetactivedirectrymembershipprvider" type="system.web.security.activedirectrymembershipprvider, System.Web, Versin= , Culture=neutral, PublicKeyTken=b03f5f7f11d50a3a" enablesearchmethds="true" cnnectinstringname="adcnnectinstring" Authr: Mike Leam P3 Prject, CIePD, University f Nttingham

2 cnnectinprtectin="secure" attributemapusername="samaccuntname" applicatinname="/"/> </prviders> </membership> This in turn depends n <cnnectinstrings> <add name="adcnnectinstring" cnnectinstring="ldap://frestdnsznes.intdir.nttingham.ac.uk:389"/> <add name="mysqlcnnectinstring" cnnectinstring="server=pustest.nttingham.ac.uk; Prt=3306; Database=pus; Uid=rt; Pwd=pus123;" prvidername="mysql.data.mysqlclient="/> </cnnectinstrings> Similarly the fllwing entry cnfigures MySQL as the Rle Prvider <rlemanager enabled="true" defaultprvider="mysqlrleprvider"> <prviders> <clear/> <remve name="lcalmysqlserver"/> <add name="mysqlrleprvider" type="mysql.web.security.mysqlrleprvider, MySql.Web, Versin= , Culture=neutral, PublicKeyTken=c5687fc88969c44d" cnnectinstringname="mysqlcnnectinstring" autgenerateschema="true" Authr: Mike Leam P3 Prject, CIePD, University f Nttingham

3 applicatinname=" MySQLRlePrvider " /> </prviders> </rlemanager> This similarly relies upn <cnnectinstrings> <add name="adcnnectinstring" cnnectinstring="ldap://frestdnsznes.intdir.nttingham.ac.uk:389"/> <add name="mysqlcnnectinstring" cnnectinstring="server=pustest.nttingham.ac.uk; Prt=3306; Database=pus; Uid=rt; Pwd=pus123;" prvidername="mysql.data.mysqlclient="/> </cnnectinstrings> As lng as autgenerateschema="true" is set t true in the rlemanager cnfig, ASP.NET autmatically creates the necessary tables t manage rles in the MySQL Database specified at mysqlcnnectinstring ASP.NET will create the fllwing tables in the Databases my_aspnet_applicatins my_aspnet_membership my_aspnet_prfiles my_aspnet_rles my_aspnet_schemaversin my_aspnet_sessincleanup my_aspnet_sessins my_aspnet_users my_aspnet_usersinrles Rles can be created, and users then assigned t them, either manually r by using the ASP.NET Web Site Administratin Tl. It can be tricky t get this wrking prperly and it appears t be smewhat flaky but n ur cnfiguratin, the fllwing steps allwed the cnfiguratin tl t run prperly. (1) Launch Visual Studi (2) Launch yur Web Applicatin prject in Debug mde ( (3) Click n the ASP.NET Cnfiguratin ptin n the Prject Menu (4) Make sure yu skip past any break pints set up in yur prject Authr: Mike Leam P3 Prject, CIePD, University f Nttingham

4 (5) Click n the Security Tab and then the Rles Create r Manage rles ptin t create new rles and then assign users t them. Nte if yu are using frms based authrizatin, the rles created shuld match this in the lcatin sectin f the Web.cnfig file as shwn in the fllwing example <lcatin path="admin.aspx"> <authrizatin> <allw rles="admin"/> <deny users="*" /> </authrizatin> </lcatin> <lcatin path="accunt.aspx"> <authrizatin> <deny users="?" /> </authrizatin> </lcatin> <lcatin path="pre-register.aspx"> <authrizatin> <allw users="?"/> <deny users="*"/> </authrizatin> </lcatin> Authr: Mike Leam P3 Prject, CIePD, University f Nttingham

5 If yu want t create Rles manually in the MySQL database (e.g. if yu re having issues with the ASP.NET Web Site Administratin Tl like I did, yu need t create the fllwing recrds in yur MySQL database my_aspnet_applicatins ID = [AUTO generated] name = [as specified fr applicatinname in MySQLRlePrvider abve] descriptin [as specified fr defaultprvider="mysqlrleprvider abe] my_aspnet_membership ( Nt used here as Active Directry is being used as the Membership Prvider my_aspnet_prfiles (again this is fr smething else the prfile prvider_) my_aspnet_rles ID = [AUTO generated] applicatin Id =[the ID f the recrd createdin my_aspnet_applicatins abve - this is a freign key] name = [the same names as in the lcatin sectin f the web.cnfig] my_aspnet_schemaversin (this is autmatically ppulated by ASP.NET) my_aspnet_users applicatin Id =[the ID f the recrd created in my_aspnet_applicatins abve - this is a freign key] name = [the user ID f each user than will have specific rles assigned t them as recrded in Active Directry is Annymus = 0 last Activity Date=(n need t ppulate manually) my_aspnet_usersinrles user Id = [the IDs r the recrds created in my_aspnet_users abve - this is a freign key] rle id = [the IDs r the recrds created in my_aspnet_rles - this is a freign key] Authr: Mike Leam P3 Prject, CIePD, University f Nttingham