Comments on [security through absurdity]: Implementing Smart Card Authentication with ASP.NE...

Hi Is it spossible to somehow use this solution a...

2010-02-07T06:22:51.780-05:00

Hi

Is it spossible to somehow use this solution and to have ASP.NET web application that will use ADFS 2.0 as STS and automatically authenticate users that have inserted their Smart Cards. ADFS will authenticate users agains AD.

yep, you are correct - it's a mistake, - you can d...

2009-07-25T15:21:40.249-04:00

yep, you are correct - it's a mistake, - you can download the sample code linked from this post here:
http://securitythroughabsurdity.com/2007/05/sample-code-authentication-and.html

While I am intrigued by the usefulness of somethin...

2009-07-24T22:52:15.030-04:00

While I am intrigued by the usefulness of something like this I am bother by many different things. First your C# code is wrong. Instead of Me it should be this. Also I make the changes to my web config file as instructed and the page won't compile. Another annoyance is where is the source code that I can download?

> I was wondering if we can > acheive this just by...

2007-10-24T21:41:49.277-04:00

> I was wondering if we can
> acheive this just by IIS
> configuration changes
> instead of any code change
> in the app

Depending on your requirements, you can get away with no code changes! If all you just need to do is verify that a smart card is signed by a specific Certificate Root Authority (CA) for authentication only, then you can configure that in IIS and shouldn't need to make any application changes.

If you need to do authorization/role validation then you will have to make some code changes or setup Smart Card to map to Window accounts and use windows Groups to limit access....

Hi,We have a web application [VS 2003] using windo...

2007-10-22T09:06:00.000-04:00

Hi,
We have a web application [VS 2003] using windows authentication. We need to implement smartcard authentication for that application. I was wondering if we can acheive this just by IIS configuration changes instead of any code change in the app. Can you please help us in this?

In our scenario, we will have smartcard certs mapp...

2007-09-18T13:59:00.000-04:00

In our scenario, we will have smartcard certs mapped to windows accounts in AD. Is there anyway to tell that they user used a smartcard and not their username/password to authenticate on the local machine?

Thanks to HSPD12, we have been mandated that we will only use smartcards.

> Do you have any info on how to > implement RSA S...

2007-07-26T00:35:11.556-04:00

> Do you have any info on how to
> implement RSA SecureID token
> authentication with ASP.net.

I'm very curious about this as well - let me do some research and get back to you!

Hi J,Thanks for your article. Our company wants to...

2007-07-25T13:58:00.000-04:00

Hi J,

Thanks for your article. Our company wants to implement 2 factor authentication.We decided to use USA token instead of smartcard for the reason of not tampering with user computers. We use ASP.NET 2.0 with C#. Do you have any info on how to implement RSA SecureID token authentication with ASP.net. Do we need forms authentication along with this. Currently, we are planning to.

I appreciate your response.

Thanks,
Katta

I considered that, but I have some problems with t...

2007-04-30T16:33:40.153-04:00

I considered that, but I have some problems with that scenario:

1. A lot of our users who need to use this system are NOT in active directory.

2. Management overhead. Adding 1-to-1 mapping of several thousand users is a logistical nightmare.

3. Last, but not least, you have to know each users password setup their certificate to AD mapping. This deminishes security as someone needs to know all the users passwords other then Active Directory.

For a smaller implementation, what you suggest is very reasonable, but for a large enterprise it doesn't scale well.

Hey, j. montgomery!Very thorough work!You may look...

2007-04-30T15:53:00.000-04:00

Hey, j. montgomery!
Very thorough work!

You may look into simpler solution where the client certs are verified by IIS, then certs are mapped to windows accounts - no need for AD, and then role based authorization is applied either via URL authorization or principalpermission attribute

Here is how it can be done for web services:

http://blogs.microsoft.co.il/blogs/alikl/archive/2007/01/29/SOA_2C00_-Strong-Authentication_2C00_-Standard-Authorization-_2D00_-Cool-Solution.aspx