và không gắn với bất kỳ công ty, tổ chức, sản phẩm, tên miền, e-mail địa chỉ, biểu tượng, người, địa điểm hoặc sự kiện là có chủ đích hoặc hàm ý. Tuân thủ với tất cả các luật bản quyền hiện hành là trách nhiệm của người sử dụng | 22 Building Secure Applications Consider the Internet-based application example using IIS that is shown in Figure . a a q w Anonymous Access Disabled Role Membership Demands 10 000 Users 1 000 Users 100 Users 10 Users Figure Filtering users with gatekeepers Figure illustrates the following You can disable Anonymous authentication in IIS. As a result only accounts that IIS is able to authenticate are allowed access. This might reduce the potential number of users to 10 000. Next in you use URL Authorization which might reduce the user count to 1 000 users. File authorization might further narrow access down to 100 users. Finally your Web application code might allow only 10 users to access your restricted resource based on specific role membership. Identities and Principals .NET security is layered on top of Windows security. The user centric concept of Windows security is based on security context provided by a logon session while .NET security is based on IPrincipal and Ildentity objects. In Windows programming when you want to know the security context code is running under the identity of the process owner or currently executing thread is consulted. With .NET programming if you want to query the security context of the current user you retrieve the current IPrincipal object from . Chapter 2 Security Model for Applications 23 The .NET Framework uses identity and principal objects to represent users when .NET code is running and together they provide the backbone of .NET role-based authorization. Identity and principal objects must implement the Ildentity and IPrincipal interfaces respectively. These interfaces are defined within the namespace. Common interfaces allow the .NET Framework to treat identity and principal objects in a polymorphic fashion regardless of the underlying implementation details. The IPrincipal interface allows you to test role membership through an IsInRole
