Kabel .NET : Documentation : How Kabel .NET works

Configuring Kabel .NET
Open this document in seperate window

Quick-Jump to a section:

<uthentic.HttpDigest>

<authentication>

<cache>

<tickets>

<machineKey>

<license>

Kabel .NET offers several configuration options, which affect the behavior and operation of the base module, including ticket generation and validation, the authentication cache and HTTP Digest-specific options. These settings are specified in a custom section of the web.config file: <uthentic.HttpDigest> as documented below.

A First Example

The following snippet from a web.config shows a possible configuration, which explicitly specifies all possible settings for the Kabel .NET module:

web.config

</system.web>

<uthentic.HttpDigest>

<authentication realm="IBuySecurely">

<cache mode="all" expiration="sliding" minutes="60" />

</authentication>

<tickets timeout="60"
maxReuseCount="-1"
resourceDependent="false"
useOpaqueValue="false">

<machineKey validationKey="autogenerate" />

</tickets>

<license location="~/development.lic" />

</uthentic.HttpDigest>

</configuration>

<uthentic.HttpDigest>

No attributes at this level.

<uthentic.HttpDigest> : <authentication>

Attributes: Possible Values: Default Value:

realm [text] WebApplication
The Realm to be used for the Web Application.
Clients will use this string to hash their passwords so that the hash is only valid for the current application.

<uthentic.HttpDigest> : <authentication> : <cache>

Attributes:	Possible Values:	Default Value:

mode	none acceptedPasswords rejectedUsers all	none	The use mode of the the Authentication Cache. The Authentication Cache (AC) can store previously authenticated credential information for faster request processing. none - the AC is disabled acceptedPasswords - the AC will only be used to store accepted passwords rejectedUsers - the AC will only be used to store denied usernames all - combines the acceptedPasswords and rejectedUsers options

expiration	absolute sliding	sliding	The cache expiration option for the enabled AC; to be used with minutes attribute. absolute - cached information will expire exactly x minutes after being added to the AC. sliding - cached information will expire x minutes after last being stored / accessed / retrieved.

minutes	[number > 0]	20	"Minutes" as related to the expiration attribute.

<uthentic.HttpDigest> : <tickets>

Attributes:	Possible Values:	Default Value:

timeout	[number > 0]	300 (5 minutes)	The number of seconds for which an issued ticket is valid. All issued tickets are configured to be valid for only a limited amount of time. An expired ticket will be returned as stale and the Client will need to request a new one to re-authenticate. See About HTTP Digest, Tickets.

maxReuseCount	[any number]	5	The number of requests for which a valid ticket can be used. value less than 1 - disables this option; tickets may be used without usage count restriction until they expire according to the timeout attribute. 1 - This means that Kabel .NET will issue One-Time Tickets. The Client will have to obtain a new one for each subsequent request. Note: One-Time Tickets are additionally bound to the IP Address of the Client for security purposes. value greater than 1 - tickets can be used only for x number of requests.

resourceDependent	true false	false	Should tickets be bound to the original resource that was requested when they were generated? Tickets may contain information about the original resource (URL) they were issued for. An example: The Client received a ticket with reference to resource A but an intruder snatched this ticket and wants to access resource B with it; when employing resource-dependent tickets, the Server will require re-authentication for B, so that the intruder is denied and his harm effectively contained.

useOpaque	true false	false	HTTP Digest-specific: When returning an initial challenge, should the Server generate an opque identifier for the subsequent authentication session? This option should be used when implementing a custom Opaque Value generation function for security and audit purposes. See the Advanced Walkthrough, Overriding Other Module Methods. Important: When overriding Opaque Value Generation, each opaque value must be unique and must only be generated once. The use of GUIDs or other such identifiers for this purpose is highly recommended.

<uthentic.HttpDigest> : <tickets> : <machineKey>

Attributes:	Possible Values:	Default Value:

validationKey	autogenerate or [hexadecimal key data]	autogenerate	The cryptographic validation key to be used for signing and verifying server-issued tickets. autogenerate - Kabel .NET will generate a strong, random key within the scope of the current web application (recommended). [hexadecimal key data] - Specify a custom key string when using a web farm/multi-server environment.

<uthentic.HttpDigest> : <license>

Attributes:	Possible Values:	Default Value:

location	registry [Virtual Path] or [Directory Path]	registry	The location of the active License for Kabel .NET. registry - Kabel .NET will attempt to load an installed License from the Registry. Virtual Path - Must start with ~/ which will resolve the virtual path relative to the web application's root directory on the physical hard drive. (Server.MapPath is used internally here). Example: ~/production.lic (this will locate the file in the root directory of the web application, so the same location as web.config or global.asax) Directory Path - Example: C:\production.lic If <license> is omitted - Kabel .NET will look in the Registry for a globally installed license or license file path; use the Licensing Utility to write a license to the Registry.