Forms Authentication

Packflow security architecture was designed to rely on existing and well-proven authentication technologies, while being mostly agnostic on the authentication system's specificities. Forms authentications obeys this architectural criterion.

Hence, Forms Authentication in Packflow uses standard ASP.NET Authentication Providers. Attention was given to special use cases in a Forms authentication context.

We made our WebDAV server MS-OFBA compatible, which means you can use Forms Authentication directly in Word, when editing documents online.

Web services were also designed with Forms compatibility in mind.

Packflow can be configured with many Membership Providers, so details below may vary.

We’ll focus on a SQLMembershipProvider created from scratch. Others providers usually require fewer steps.

Create a SQL account store

Configure a Membership Provider in IIS

Enable Forms Authentication in IIS

1. Open IIS manager, select your Packflow site, then double-click the ‘Authentication’ icon.

2. Disable Windows authentication, Enable Forms and Anonymous authentication

Note
In order to have Forms authentication working within Office clients, you have to change the login page URL to an absolute URL. To change this, select ‘Forms Authentication’, click on ‘Modify’, and change the Login URL to look like this: https://ServerDomain.com/Account/Login.

Forms accounts may be managed within Packflow through the Asp.Net Membership API. External tools like ASP.NET Web Site Administration Tool can be used too.

Here is a description of typical Forms accounts management operations.

Note
The following operations' success depends on the MembershipProvider configuration. Some can be disabled in configuration file. User self registration and 'Question and Answer' password reset are not implemented within Packflow Interface at this time.

Enable Forms Management in Packflow

Enable this feature to manage Forms accounts within Packflow.

1. Navigate to "https://yoursite.local/Administration/Settings"
2. Check “Enable Forms Accounts Management”.
3. Click save.

Create a Forms account within Packflow

1. Click on “Forms Accounts” administration menu item, or navigate to https://yoursite.local/Administration/FormsAccounts.

2. Enter new credentials in the form, then click 'Add Account'.

The new user will be visible when refreshing the grid view on the left.

Password change, Password Reset

Locking / Unlocking accounts

Google Authentication

Login

When Forms authentication is enabled, user experience stays the same, excepted the login screen will have a different aspect.

The image displayed is the logo defined in the site settings.

Password change

1. Static content is not protected by default.

   Forms authentication requires loading and posting pages from the server before authentication has taken place. Hence, Anonymous Authentication is always required when setting up such system, allowing the user to load the ‘Login’ page and static contents like CSS or Javascript before authentication.

   We use ASP.NET authorization rules to restrain unauthenticated users to only load ‘Login’ form and WCF services. These rules are not evaluated when pointing at static files, letting them accessible.

   Note
   Static content risk can be mitigated by forcing the ISAPI handler to handle static files, but this creates huge performance overhead. Please note that files held in Packflow FileHolders and user pictures are not static content and don’t suffer any security degradation when in Forms mode.

2. SSL/TLS must be used in production.

   SSL/TLS with a valid certificate should always be used in this configuration.

   TLS ensures transport security and server authentication via certificate validation.

   If no SSL is present, the username and password will travel the network unencrypted.

   If no signed certificate is present, the user has no guarantee on where he will post his credentials. (MITM attack possible).

   Note
   Packflow won't warn the user if Forms authentication is used over HTTP, since it is a common developer's configuration.

3. User Accounts Security

   Account security is dependent on the chosen MembershipProvider implementation and settings.

   Packflow won’t store or validate credentials itself, but will delegate this to the configured MembershipProvider.

   This allows you to use any available MembershipProvider implementation, even a bad one.

   To be short, it is your responsibility to provide a valid and safe MembershipProvider as an account store.

1. Overview

   WCF Services in Packflow work in Asp.NET compatibility mode. This makes them more dependent on the IIS pipeline. The most visible effect is how the asp.net authorization rules affect services as well.

   To be authenticated, requests to WCF Service have to bypass the ‘Redirect to Login page’ feature of Forms authentication, and the client has to provide the credentials with every request. The service will validate those credentials against the same membership provider as the site, allowing consistent authentication control.

   There is no specific protection of the credentials in the message layer. SSL/TLS is then strongly encouraged in http web services for a production environment.

   

2. Configuration Steps

   1. In the authorization.config file, under "<configuration>", add this markup and update the path to your WCF service.

      The unauthenticated request won’t be redirected to your login page anymore, so the service will be able to receive and validate unauthenticated requests.

      XML

      Copy

      <location path="/ApplicationName/Services/MyWCFService.svc">
        <system.web>
          <authorization>
            <allow users="?"/>
          </authorization>
        </system.web>
      </location>

   2. Add a service behavior relying on the Membership Provider.

      In [VirtualDirectory]/Services/Web.Config, under <configuration> < system.serviceModel><behaviors> <serviceBehaviors>, add this markup and choose a membership provider name matching the site’s provider.

      You may change the behavior name as well. Setting no name will set this behavior as default.

      The membership provider must be properly configured. See Setup section.

      XML

      Copy

      <behavior name="UserNameProtectedServiceBehavior" >
        <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
        <serviceCredentials>
          <userNameAuthentication userNamePasswordValidationMode="MembershipProvider"
              membershipProviderName="PackflowMembershipProvider"  />
        </serviceCredentials>
      </behavior>

   3. Configure a service binding.

      Binding configurations vary upon chosen binding type. Here are two valid markups for BasicHttpBinding.

      The former is for production environments and requires SSL, the latter allows unencrypted transport and is for development only.

      These markups have to be located in [VirtualDirectory]/Services/Web.Config, under <configuration><system.serviceModel><bindings><BasicHttpBinding>

      XML

      Copy

      <binding name="SSLBasicHttpBinding" allowCookies="true">
        <security mode="TransportWithMessageCredential" >
          <message clientCredentialType="UserName"></message>
        </security>
      </binding>

      XML

      Copy

      <binding name="NoSSLBasicHttpBinding" allowCookies="true">
        <security mode="None" >
          <message clientCredentialType="UserName"></message>
        </security>
      </binding>

      To override default binding and behavior for all services, add a <clear/> tag before the binding and behavior markups, and don't set the 'name' property of those.

   4. Assign new binding and behavior to your service(s).

      Under <configuration><system.serviceModel><services>, locate the services you want to protect.

      Add or update behaviorConfiguration, bindingConfiguration attributes like in the example below.

      This step is unnecessary if the binding and behavior were configured as the default ones (without name). Use [VirtualDirectory]/Services/Web.Config file.

      XML

      Copy

      <service name="DataService" behaviorConfiguration="UserNameProtectedServiceBehavior">
          <endpoint contract="IDataService" binding="basicHttpBinding" 
            bindingConfiguration="SSLBasicHttpBinding" >
          </endpoint>
      </service>

   Your WCF Service is now protected via Membership Provider.

   Security Note
   Service metadata requests (wsdl) remain unprotected. You may update your <serviceMetadata/> tag to restrain access to this functionality.