Can this be done? User authentication and webpage

[itdamon]

I need a way to have a user log on to our website using his normal username and password, and be re-directed to a custom web page to view his financial information.

Do I need to use an .ASP page? Can I do it with NTFS permissions? Can I do it using his home folder? What about a logon script? I don't know! Can someone steer me in the right direction...or the right forum for this post?

Thanks,
Damon

 

[Ransoft]

Yes you can use ASP to do it. If this is a page on a remote server...such as yahoo for example and having to login to their email...I would personally use ASP.

I have a login command that is accessing a database and session IDs at this site

http://www.fsubcm.org

I will not post my code, however there are tutorials on this out there. I'm sorry if I am vague, but without knowing the nature of the site I have to be.

 

[itdamon]

Nice website Ransoft.
Now can you direct each user to a different webpage based on his username/password? This is the site I'm trying to redesign

http://www.bamsi.com/logon.htm

use guest/guest to logon.

I'm using a java applet to redirect each owner to their personal financial information based on their logon. I'd like a more secure way of doing this than I am now. (such as an ASP and Access database solution, or by using my Windows 2000 server and Active Directory to authenticate)

I'm not asking anyone to handout their code. Just point me in the right direction to where I can find more info

Thanks,
Damon

 

[Ransoft]

I just got back into town.

Yes you can redirect them. My method is somewhat crude, but I have it to where each person who visits the website and registers is assigned a random usercode that is there's only.

Also I have a field in my db that stores access levels.

When a user logs in, I have a few variables stored in a cookie on their hardrive once they are approved. The sites then read these variables and show the information depending on what "status" or in your case customer they are.

One possible way would be to have it store their user id in a cookie, then redirect to their information from purely reading that and that only.

Once they have the user id, then it reads the rest of their info and you can display it accordingly.

Also you can put these files in the ssl layer of your server to make them secure.

My method is pretty easy, and there is a probably a more secure way out there...like setting the cookie variables to expire after a certain time..which is pretty easy...

you could just bypass the cookie part and have the asp code read the server sessions variables in real time. There is a trend towards this approach as it keeps it all server side.

http://www.asp101.com

is a very basic website that shows all of the above steps in a very simple way...you can then expand upon them and maniuplate the code to your liking.

Its kinda easy if you are familiar with programming. Make sure the db is in a place where no one can view or dl it...server company and since you are talking active directory you can probably set that...

also use .inc (include files) for a lot of the sensitive code..these are hard to find..as when the asp page is accessed you can't view these files at all unless they are known...put these files in the ssl layer...

etc...