I am working at a company which uses an intranet site as a portal to a bunch of other local sites. Unauthorized people in the company have been accessing it, so we want to secure it. Users, when accessing the website for the first time will have to enter a username and password. If they are on a certain group in the Active Directory, they will be given access and their credentials will be stored so that they don't need to enter their username/password again. I have looked into NTML, ASP.NET, but am not sure how to proceed.
Any thoughts/ideas are greatly appreciated.
Dump your solution. Use Integrated Windows Authentication, namely Kerberos, in IIS. It will automatically pass all credenentials to your server. Note that every participant must be part of your AD domain.
Related
I'm trying to get some data from a user (searchconsole):
the user first grants permission on a website.
Then, the idea is to use that permission and retrieve the data with a python program that'll run on a different server.
What is the easiest/safest way to achieve that?
Should I use the same token for both servers?
or is there a solution using the service account impersonation? (I'm stuck on that one)
use the permission on the web server to add the service account as a searchconsole user?
I tried to move the token from one server to another manually, and it works, but it seems suboptimal to use the same token for both servers.
I also read the doc and all examples I could find, but didn't find my case even though it seems basic.
Should I use the same token for both servers?
Im not 100% sure what you mean by token, you can and probably should just store the refresh token from the user and then you can access their data when ever you need to. This is really how Oauth2 is supposed to work and maybe you could find a way of storing it in a database that both your fount end and backend can access.
or is there a solution using the service account impersonation? (I'm stuck on that one)
Service accounts should really only be used if you the developer control the account you are trying to connect to. or if you are a google workspace admin and want to control the data of everyone on your domain. impersonation can only be configured via google workspace and can only be configured to control users on the same domain. So standard google gmail users would be out.
In the case of the webmaster tools api im not sure by checking the documentation that this api even supports service accounts
use the permission on the web server to add the service account as a searchconsole user?
I did just check my personal web master tools account and it appears that i have at some point in the past added a service account as a user on my account.
For a service account to have access to an account it must be pre authorized. This is done as you can see by adding a user to your account. I cant remember how long ago I tested this from what i remember it did not work as the user needed to accept the authorization and there was no way to do that with a service account.
I might be on the wrong section to ask this but.
After signing up with Blue Host, for a personal website blog, i know i have the ability to add extra websites for free, however would it be possible for me to add someone else website that i don't own but gave me permission to add and i let them host their website on my plan.
can they still access their account without me giving them my blue host details.its kinda of a stupid question, once i think about it.
any help will do.
You can do it in one way..
STEP-1
You have to create different FTP accounts for all users and provide a seperate folder to all users they can access that folder only via FTP details.
They can add/update/delete files that they owns.
STEP-2
Tell you user to forward his/her domain to yousite.com/folder-assign to FTP
FINISHED
Now what happen when someone open your users site.
lets says your domain is YOURDOMAIN.COM and your user domain is MYUSERDOMAIN.COM, now your user have forwarded his/her domain to your domain YOURDOMAIN.COM/FOLDER_ASSGIN to FTP
-In URL user see their own domain name MYUSERDOMAIN.COM actually it opens your site's folder that is assign to your user
I have an application on windows azure where users are authenticating by using ACS ( with ADFS 2.0).
There is a requirement that before certain actions, the user must confirm his identity by retyping his password.
Is there some way to ask ACS to check for credentials when a user is already signed in?
For a moment I thought about checking against the cookies created for the authentication, but I am not really sure that is possible. Besides, this feels just wrong.
Any ideas? I have been trying to search for REST apis of azure's ACS but it seems there are only management api calls for ACS.
There's no way to do this other than signing the user out and making them sign back in again. Even that, though, won't guarantee a password entry in all cases. If ADFS is configured for integrated auth (Kerberos), and the user is on a domain joined machine, they may never have entered their credentials and there's nothing you can do to force them to.
I am using joomla 3.0 and i want to when user open joomla 3.0 site then first open only login page then after login he can access website.
Thanks For Advance
You can put the site in offline mode.
So the site will display the login page.
Remember to grant permissions to the users to access the offline site!
If you want to "protect" the whole site with login the best option is to turn the site off and then the user will need to login after opening the intranet page. Its probably the cleanest way how to to it without modules/plugins.
As we are doing it in my company (we are also running intranet on Joomla!) is, that all the articles are set to registred and the landing page of intranet just contain warm welcome and login form.
One thing to mention: Forcing this login for viewing some article/other content is not secure at all, mostly the local instalation will run on database with root access without pass (default setting) and with unecrypted database easily accessible. This is something to consider. If you are running this intranet in small company with loyal employees or without sensitive information you should be fine if not you should put more stress on the security issues.
Basically, all I did was redirect an old website in IIS management to a new local directory, and now all the pages suddenly require the HTTP authentication. I have checked the settings, and Enable Anonymous Access is checked, and lists a guest user. I then tried creating a new local user, making it guest-group member only, and entered that into the website IIS settings to use.
Still no luck. Why does IIS suddenly want authentication? What changed??
Check the permissions on the directory to ensure that the user Internet Guest Account has read access.
Check account under which apppool is running. Does it have access on website folder?