• The process of authentication is necessary in most programs and software to determine the user's identity. Determining the user's identity is essential for many reasons, one of which is to avoid unauthorized access to a program and to secure the program's information and accessibility. The different types of authentications in ASP, Microsoft's website framework, use different approaches for the authentication process.
  
  

Windows Authentication

• Windows authentication in ASP is preferred when users are part of the Windows domain or are within the Microsoft Windows Active Directory. This type of authentication can couple with the Internet Information Services (IIS) authentication. Unlike the other types of authentication, Windows authentication does not transmit passwords or other user credentials over the network. Windows authentication has three types: basic, digest and Windows integrated. Basic authentication requires credentials such as a username and password, which are sent in encoded text, making it unsecure and recommended for use only with Secure Sockets Layer (SSL) to protect the user. With digest authentication, the credentials are transferred as one-way hashed (or shortened), and it requires the use of the Active Directory where all the user information is stored. Windows integrated authentication is much like basic authentication but uses a more sophisticated hashing algorithm; unlike basic authentication, it does not transmit user credentials over the network and works well in an intranet environment.
  
  

Forms Authentication

• Forms authentication uses a cookie, which contains the authentication ticket created when a user logs in. Some versions of ASP support cookie-less forms authentications and send the ticket in a query string. If a user visits a page that requires authentication when he has not previously logged in to it, he is directed to a configured logon page that prompts him to enter his username and password. These credentials are passed to the server, then authenticated through a user store such as an SQL Server database. The requested page then loads.
  
  

Passport Authentication

• Passport authentication uses Microsoft's passport service. Passport users are considered authenticated already and will not be asked for any credentials when logging in to a site or requesting a secure page. Passport authentication uses an encrypted cookie mechanism to indicate a passport user. Passport servers require non-passport users to log in before showing them the requested page.
  
  

None/Custom Authentication

• In ASP, you can also implement a customized authentication method by combining any of the three previously mentioned methods for an even more secure authentication process. You can also perform a URL authentication, one of the most common customized authentication processes, or use an HTTP module. Authentication can be nullified for certain conditions by setting the authentication mode to "None" (see Resources).