Web Security with ASP.Net Security

[longisl]

I am relatively new to Alpha. I currently have an ASP.Net web application that uses ASP.Net's membership security system. I'd like to know if Alpha can use ASP.Net's security tables in lieu of those that are automatically generated by Alpha. If not, another solution that may solve my problem is using Microsoft's latest security system, ASP.Net Identity which apparently allows customizing the security tables which wasn't true of the older Membership system. In this case I'm envisaging adding the Alpha tables to the same database that ASP.Net uses. In the end, I want to avoid using 2 separate user/password databases for each application. Alpha is going to be the mobile app and ASP.Net is going to be the web based app. Both are using the same database tables for data entry and editing. Any advice would be greatly appreciated.

[Steve Wood]

Re: Web Security with ASP.Net Security

If those ASP tables matched the ones needed by Alpha, then yes you could use the "ASP" tables. You would have to study how the Alpha Five table structure for security (tables typically named websecurity*.) If you get that far, I can describe how the Alpha tables are connected (primary key, foreign key, etc.)

[longisl]

Re: Web Security with ASP.Net Security

Thanks for the quick reply. Recreating the Alpha security tables structurally in SQL server amongst the ASP.Net security tables isn't really my main concern. I know it's possible. What I am troubled with is how do I call the encryption function in Alpha (XBasic?) from my web page in ASP.Net when an administrator sets up a new user. My web app will create an encrypted password using a hash alogorithm native to ASP.Net. It may or may not be compatible with the Alpha security table. That's my main worry. Could a SQL Server trigger on my security table add a username and password to the Alpha security table?

[Steve Wood]

Re: Web Security with ASP.Net Security

It could be worked out. I am the author of a method for using LDAP server to authenticate user logins on Alpha Five based on a HASH value (but one that Alpha understands), and I also integrated auto-registration and auto-login to a PHP based system (Simple Machines Forum) based on login to an Alpha Five application.

Your situation would require either a) pass the PHP-encrypted password to Alpha, we can call a PHP function to decrypt, then re-encrypt using Alpha's required algorithm, or b) you decrypt on the PHP side, send to Alpha using an encryption method that Alpha understands... etc.. I'm not saying it is simple, but it can be worked out.

[longisl]

Re: Web Security with ASP.Net Security

I sort follow what you're proposing since my experience with security issues is thin at best. What encryption does Alpha use? Is the function to encrypt a password callable from outside of Alpha, i.e. from within a C# method, if a reference is made to the XBasic library?

Thanks,
Peter

[Steve Wood]

Re: Web Security with ASP.Net Security

From my understanding, the standard Alpha password encryption is NOT available to the developer, or rather the encryption KEY is not available. But you don't need to know it. Alpha has standard functions that take Userid, password (clear text or encrypted using a known key from your side), and other security information, and pushes it in to their security model. So you don't need to pass the security data directly to the table, in fact could not because of the encrypted password problem.