Authentication and Authorization

chetan Allipur

9y882Learn iOS Programming

Explain in brief what is Authentication and Authorization in web Config file?

4 Replies

Know the answer? Post it — somebody with the same question will find it here.

Chetan Ranpariya9y ago
Accepted answer
Hi Chetan,

Following are the generic definitions of Authentication and Authorization.

Authentication is the process of validating if the user who is trying to access the applicatiion is a valid user or not. Validating is done by various ways such as asking user to enter username and password or signature verification etc.

Authoriazation is the process of verifying if the authenticated user can access certain part/feature/fuctionality of the application. This we do by granting user to the permission or assigning a role to the user and allowing access to specific part/feature/functionality of the applicaton to that role.

In Web.config,
Authentication is configured by setting type of the authentications such as Forms, Windows or None.

Authorization is configed by allowing or denying roles or usernames to access specifc paths or files types in the application.

Please go thru the following article which explains this with very good details.

https://www.codeproject.com/Articles/98950/ASP-NET-authentication-and-authorization

Thanks and regards,
Chetan Ranpariya
Bikesh Srivastava9y ago
Whatever i have done i think best practice for authentication and autherization is OWIN with identity.
Khaja Moizuddin9y ago
In Asp.net we have a security concept for checking the valid user who request for the webpage or not ,we have two terminologies used in security concept 1) Authentication : It is a process of Authenticating the user when user requests for the restricted webpage, if the user is a valid user then we will provide the restricted webpage to the user. If the user is a valid user then IIS will be generating with an Ticket. 2) Authorization : It is a process of checking Authorized user or not to access the restricted webpage. IIS will provide you with the restricted webpage who are having the ticket based on type of authentication,like we have three types of authentication ie.Forms Authentication, Passport Authentication, Windows Authentication. Hope this helps you.
Nitin Sontakke9y ago
First, please do not consider that authentication and authorization is specific to web.config. This is a generic concept and is applicable everywhere.

When your friend comes to your house, you authenticate that s/he is indeed your friend and let him/her get in your house. But you do not authorize him/her to access your safe/locker. Simple.