|
OK, a couple of questions.
How does the website store the userID?
How does the website know when someone is logged in? (what authentication model are you using?)
How does your website know when someone is not logged in? Have they just closed their browser without logging out? Does this action automatically log them out?
I am assuming from what you have said that you are not using windows accounts to authenticate the user, but are making them use a different set of Username and Password to authenticate against the website.
My first suggestion is that you use ldap to control access and authentication for both of your applications. In the long run it makes things very simple. You can provide or deny access just by adding or removing them from an active directory group. You can even have multiple levels of access.
If you are unable or unwilling to do that, you could tie the AD account of your users to their web membership data and then query this from your c# application. It depends on how you have your authentication code set up.
From your outline, I would abandon trying to get the website to write to the client machine and concentrate on getting your C# application to interact with your web membership data.
|
|
|
|
|
Web-based application is integrated with an LDAP which is linux based.
authentication is against ... LDAP. this is taken care by the application.
and if the user has not looged out properly, this thing we don't need to consider.
my C# application doesn't need any kind of authentication which doesn't need any login credentials by itself, it needs the userid of the web-app so tht it can pop-out a new web-page of the same web-app so tht the user doesn't need to give his log-in credentials for the web-app.
|
|
|
|
|
If both applications are authenticated against ldap, then why can't you just pick up their userID from there? If they are different ldap's that should not be too much of a problem, you can script a custom field in your first ldap where you store the the userID of the other one. (or even - if you must - have a database table where you store both and just run a quick query)
Just an idea.
|
|
|
|
|
the problem here is the desktop or the user m/c s are shared by different users, so there is no standard set of users who will be using this web-app. it is very dynamic.
and C# application is just a windows based application, it doesn't have any database. So it has to pick up the current user who is loigged in to the web-app dynamically wt the point when it is invoked.
|
|
|
|
|
If I am reading you right,
The user logged onto the desktop is not necessarily the user who is logged onto the web app?
That sounds like a security nightmare to me!
As a first thought I would go back to a server based approach and when they authenticate to the web site, log their ldap user name and the computer name of their machine. Then when the C# app opens, find the computer name and get their ldap userID from there.
This is just first impressions, not sure what the loopholes in that may be.
Signing off now. - I Hope you get this sorted.
|
|
|
|
|
Yeah the title you gave is very apt... it is a security nightmare in deed !!!!!!!
the web-app we are talking about is a huge Enterprise Management tool which makes it hard to change the architecture of this product.
|
|
|
|
|
I teach elementary and I'm looking for a simple
tool or software to develop meaningful stories for my students.
The idea is to input data in the first page (Title) as
the student name, favorite color, food, game etc.
Then in the following pages the text in the first page will
appear in a simple sentence according to the story
events. Also pictures and graphs should be enhancing the
mini book.
Help!
Intefa
Intefa
|
|
|
|
|
Hello Friends,
I'm putting javascript validations in Master Page's Content Page as given below and also it is working great.
function validate1()
{
if(document.getElementById("<%=txtOldPassword.ClientID %>").value=="")
{
window.alert("Please Enter Old Password");
document.getElementById("<%=txtOldPassword.ClientID %>").focus();
return false;
}
}
But a problem raise when i use this piece of code in <b>.js</b> file
and give the path as given below......
<b>
<script language="javascript" src="../Script/Validations_Login.js">
</script>
</b>
|
|
|
|
|
But what is the problem ????
|
|
|
|
|
First of all, actually i've to ask this question in ASP.NET block
I dont know the problem but there is a Error on Page that is object required
|
|
|
|
|
Put the javascript code in the MasterPage itself and not in the content page.
Thanks
Laddie
Kindly rate if the answer was helpful
|
|
|
|
|
which code ?????????
if u r talking about my javascript validation(s) code then i've already explained it tht it's working fine if i put the code in the content page. But if i put this code in the .js(javascript file) and provide the src from the content page then it doesnt work properly......
Plz explain
Thnx
|
|
|
|
|
You're asking an ASP question in the WebDev forum. There's an ASP.NET forum. Please ask future such questions there.
And your code is breaking 'cause ASP doesn't process JS files. So the bits between <% and %> don't get turned into element IDs like you need them to be.
---- ...the wind blows over it and it is gone, and its place remembers it no more...
|
|
|
|
|
Shog9 wrote: And your code is breaking 'cause ASP doesn't process JS files.
Besides, even if the js files were processed, the server code refers to controls that are in the page, not in the js file.
Despite everything, the person most likely to be fooling you next is yourself.
|
|
|
|
|
Yeah. I got the impression he thought it operated like a server-side include where the contents of the file was inserted prior to processing or something.
But who is the king of all of these folks?
|
|
|
|
|
Hello guys.
I have an update problem that with my logoncheck.asp and when I googled the problem I found out it might be permission problems on the database.
Now I have tried to grant permission on the database folder properties to allow read/write, but I still get the same error.
Is there another way I can use to maybe grant this permission.Unless there is something else Im doing wrong.
The error is Error # -2147467259 Operation must use an updateable query.
SQL = UPDATE tbl_employees SET lastlogin = #29-Feb-2008# WHERE employeelogin = 'SIPHOSIBUYANE'
Code is :
]]>
"" and request.Cookies("shark_password") <> "" and request.form("ccokie") <> "false" then
strUserid = request.Cookies("shark_user_id")
strPassword = request.Cookies("shark_password")
boolFromCookie = True
end if
end if
'-----------------------------------------------------
'-----------------------------------------------------
'Level 1 Basic Validation Testing
'-----------------------------------------------------
'-----------------------------------------------------
'Test for Entry of Member ID prior to Running Search
'-----------------------------------------------------
if (strUserID="") then ' Member ID Entered
session("msg") = "
" & dictLanguage("Error_NoUserID") & ""
Response.Redirect "default.asp?opt=1"
'Run Search
'-----------------------------------------------------
else 'Run Database Lookup
sql = sql_GetEmployeesByLogin(strUserID)
'response.write sql & "
"
Set rs = Server.CreateObject("ADODB.RecordSet")
rs.open sql, conn, 3, 3
end if
'-----------------------------------------------------
'-----------------------------------------------------
'Level 2 Validation Testing
'-----------------------------------------------------
'-----------------------------------------------------
'Member ID Entered Now Run Search for Record
'-------------------------------------------
If rs.eof Then 'No Record Found, Bad ID
rs.close
session("msg") = "
" & dictLanguage("Error_NoUser") & " " & strUserid & ". " & dictLanguage("Please_Try_Again") & ""
Response.Redirect "default.asp?opt=1"
'Customer Record Found Now Check Password
'-----------------------------------------
elseif not Ucase(strPassword) = Ucase(rs("password")) then
rs.close
session("msg") = "
" & dictLanguage("Error_InvalidPass") & "
" & dictLanguage("Please_Try_Again") & ""
Response.Redirect "default.asp?opt=1"
'Check for inactive status
'-------------------------------------------
elseif rs("active") <> 1 and not rs("active") then
rs.close
session("msg") = "
" & dictLanguage("Error_InactiveAcct") & ""
Response.Redirect "default.asp?opt=1"
'-----------------------------------------------------
'-----------------------------------------------------
' Step 3. Success Logon Approved
'-----------------------------------------------------
'-----------------------------------------------------
else
'check their permissions
sql = sql_GetEmployeesPermissionsByID(rs("Employee_ID"))
Call RunSQL(sql, rsPerms)
if not rsPerms.eof then
'give them the permissions they have been assigned
if rsPerms("permAll")=1 or rsPerms("permAll") then
'let them do everything
session("permAdmin") = TRUE
session("permAdminCalendar") = TRUE
session("permAdminDatabaseSetup") = TRUE
session("permAdminEmployees") = TRUE
session("permAdminEmployeesPerms") = TRUE
session("permAdminFileRepository") = TRUE
session("permAdminForum") = TRUE
session("permAdminNews") = TRUE
session("permAdminResources") = TRUE
session("permAdminSurveys") = TRUE
session("permAdminThoughts") = TRUE
session("permClientsAdd") = TRUE
session("permClientsEdit") = TRUE
session("permClientsDelete") = TRUE
session("permProjectsAdd") = TRUE
session("permProjectsEdit") = TRUE
session("permProjectsDelete") = TRUE
session("permTasksAdd") = TRUE
session("permTasksEdit") = TRUE
session("permTasksDelete") = TRUE
session("permTimecardsAdd") = TRUE
session("permTimecardsEdit") = TRUE
session("permTimecardsDelete") = TRUE
session("permTimesheetsEdit") = TRUE
session("permForumAdd") = TRUE
session("permRepositoryAdd") = TRUE
session("permPTOAdmin") = TRUE
elseif rsPerms("permAdminAll")=1 or rsPerms("permAdminAll") then
'give them permissions to all admin tasks
session("permAdmin") = TRUE
session("permAdminCalendar") = TRUE
session("permAdminDatabaseSetup") = TRUE
session("permAdminEmployees") = TRUE
session("permAdminEmployeesPerms") = TRUE
session("permAdminFileRepository") = TRUE
session("permAdminForum") = TRUE
session("permAdminNews") = TRUE
session("permAdminResources") = TRUE
session("permAdminSurveys") = TRUE
session("permAdminThoughts") = TRUE
end if
'get individual admin permissions
session("permAdmin") = rsPerms("permAdmin")
session("permAdminCalendar") = rsPerms("permAdminCalendar")
session("permAdminDatabaseSetup") = rsPerms("permAdminDatabaseSetup")
session("permAdminEmployees") = rsPerms("permAdminEmployees")
session("permAdminEmployeesPerms") = rsPerms("permAdminEmployeesPerms")
session("permAdminFileRepository") = rsPerms("permAdminFileRepository")
session("permAdminForum") = rsPerms("permAdminForum")
session("permAdminNews") = rsPerms("permAdminNews")
session("permAdminResources") = rsPerms("permAdminResources")
session("permAdminSurveys") = rsPerms("permAdminSurveys")
session("permAdminThoughts") = rsPerms("permAdminThoughts")
session("permClientsAdd") = rsPerms("permClientsAdd")
session("permClientsEdit") = rsPerms("permClientsEdit")
session("permClientsDelete") = rsPerms("permClientsDelete")
session("permProjectsAdd") = rsPerms("permProjectsAdd")
session("permProjectsEdit") = rsPerms("permProjectsEdit")
session("permProjectsDelete") = rsPerms("permProjectsDelete")
session("permTasksAdd") = rsPerms("permTasksAdd")
session("permTasksEdit") = rsPerms("permTasksEdit")
session("permTasksDelete") = rsPerms("permTasksDelete")
session("permTimecardsAdd") = rsPerms("permTimecardsAdd")
session("permTimecardsEdit") = rsPerms("permTimecardsEdit")
session("permTimecardsDelete") = rsPerms("permTimecardsDelete")
session("permTimesheetsEdit") = rsPerms("permTimesheetsEdit")
session("permForumAdd") = rsPerms("permForumAdd")
session("permRepositoryAdd") = rsPerms("permRepositoryAdd")
session("permPTOAdmin") = rsPerms("permPTOAdmin")
for each i in session.Contents
if session(i)<>"" then
if len(session(i))>4 then
if left(session(i),4) = "perm" then
if session(i) = 1 or session(i) = -1 then
session(i) = TRUE
elseif session(i) = 0 then
session(i) = FALSE
end if
end if
end if
end if
next
'check to see if they have any admin permissions at all, if so give them access to
' the admin folder
if session("permAdminCalendar") or session("permAdminDatabaseSetup") or _
session("permAdminEmployees") or session("permAdminFileRepository") or _
session("permAdminForum") or session("permAdminNews") or session("permAdminResources") or _
session("permAdminEmployeesPerms") or session("permAdminSurveys") or session("permAdminThoughts") then
session("permAdmin") = TRUE
end if
else
session("permAdmin") = FALSE
session("permAdminCalendar") = FALSE
session("permAdminDatabaseSetup") = FALSE
session("permAdminEmployees") = FALSE
session("permAdminEmployeesPerms") = FALSE
session("permAdminFileRepository") = FALSE
session("permAdminForum") = FALSE
session("permAdminNews") = FALSE
session("permAdminResources") = FALSE
session("permAdminSurveys") = FALSE
session("permAdminThoughts") = FALSE
session("permClientsAdd") = FALSE
session("permClientsEdit") = FALSE
session("permClientsDelete") = FALSE
session("permProjectsAdd") = FALSE
session("permProjectsEdit") = FALSE
session("permProjectsDelete") = FALSE
session("permTasksAdd") = FALSE
session("permTasksEdit") = FALSE
session("permTasksDelete") = FALSE
session("permTimecardsAdd") = TRUE 'we want them to be able to add time right?
session("permTimecardsEdit") = FALSE
session("permTimecardsDelete") = FALSE
session("permTimesheetsEdit") = FALSE
session("permForumAdd") = FALSE
session("permRepositoryAdd") = FALSE
session("permPTOAdmin") = FALSE
end if
rsPerms.close
set rsPerms = nothing
session("logonstatus") = 1
session("userid") = Ucase(rs("EmployeeLogin"))
session("employee_id") = rs("Employee_ID")
if gsAutoLogin then
if not boolFromCookie then
Response.Cookies("shark_user_id") = session("userid")
Response.Cookies("shark_user_id").expires = #12/31/2010 00:00:00#
Response.Cookies("shark_employee_id") = session("userid")
Response.Cookies("shark_employee_id").expires = #12/31/2010 00:00:00#
Response.Cookies("shark_password") = request.form("password")
Response.Cookies("shark_password").expires = #12/31/2010 00:00:00#
else
session("cookieMessage") = dictLanguage("User") & " " & request.Cookies("shark_user_id") & " " & dictLanguage("logged_on") & " [" & Now() & "]
" & dictLanguage("click") & " " & dictLanguage("here") & " " & dictLanguage("logon_diff_user") & "."
end if
end if
sql = sql_UpdateEmployeesLastLogin(now(), strUserID)
Call DoSQL(sql)
rs.close
response.redirect "main.asp"
end if
rs.close
%>]]>
kagiso
|
|
|
|
|
Hi I also face the same problem while uploading my first web site, see if your program or webpage executes perfectly in offline mode then there are no problem with the code.
This type of error occor mostly due to read write permission of the database, of it could the cause of cookies and caching and in this case try again after removing the cokkies and offline content from your system.
With Regards
Yogesh Agarwal
|
|
|
|
|
First thank you for the response, but unfortunately this site has to fun from my hosting company, so I cant test it offline.I have removed all the cached files and deleted the history, and still.Nothing happens.
Is it possible that the hosting company could maybe check if their server grants access rights to my database??
kagiso
|
|
|
|
|
This is possible but did you havn't the control panel details for the site you are developing??
And in your post you are tried to say that you have to write code then upload it on the server to check the effect of your code, you can't even use F5 option to debug for site. and if it is so then only the hosting company will help you.
Yogesh
|
|
|
|
|
I have just contacted the service provider and they tell me that they will escalate the query.The problem is that, when I put in the wrong username and password, I get the right message (Make sure ur username and password are correct), but when I put in the right username and password, I get the error (Make sure the operation uses an updatable query).So it most definitely has to be permission issues.
But they promised to call me back.
Thanx again.
kagiso
|
|
|
|
|
It's the user account used for running the ASP.NET code that needs permission to the database file, usually the account IIS_WPG.
Check also that the file is not simply write protected.
Despite everything, the person most likely to be fooling you next is yourself.
|
|
|
|
|
Well, I checked the database folder and I gave read/write permissions to my account but I still have the problem.Now I dont knw what to do.
Im on asp by the way, not asp.net.
kagiso
|
|
|
|
|
The same thing applies to ASP; it's not your user account that is used to run the ASP code.
Check the settings for the web site in IIS manager to find out what user account is used to run the application.
Despite everything, the person most likely to be fooling you next is yourself.
|
|
|
|
|
Well, IIS is not a problem.The site runs perfectly from IIS, but we just posted the site onto the new ISP FTP folder and its doing this.
kagiso
|
|
|
|
|
Files that you upload to the ISP normally isn't writable by the account running the ASP code. An ISP that supports Access usually has a pre-created folder especially for database files, that has the appropriate security settings.
Despite everything, the person most likely to be fooling you next is yourself.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
