I am writing line of business software for a company, and we want to authenticate users, so we can manage workflow and do some auditing. Basically my employers don't want me to piggyback off of windows authentication because of certain network restrictions (I really don't want to get into it but its a mixture of poor network setup and bosses wanting to know if there is another way to do it)
I am using c#, wpf, MVVM, PRISM
I've read a bit about hashing passwords, salting, etc and the more I read the more I realise that I really should not be writing the security section of this program, as I am basically faaaaaaar from qualified.
Eric Lippert has a very good basic intro into security, in which he warns the reader at the beginning that you should not be designing your own security system as you do not know enough.
I want to know, what are the alternatives?
Seeing as I'm not supposed to write it myself, I would like to know where should I get it from?
Do I hire security experts to write it with?
Is there a third party security program I should interface with?
Do I outsource the design but implement it myself?
Who is the big player in this industry that I should look at?
In answer to questions raised by Steve:
Where is the data?
- Well this hasn't been decided yet. I thought there might be some system which can house the authorisation data (and calls to and from it) in a secure way and was wondering what that system might be. However we have a SQL server which I imagine will probably be where the data would be kept. So the data is stored on a Microsoft SQL server and would be accessed somehow by clients on the network (in order for the clients to authenticate). It is conceivable that I write an authentication service that runs on this server and accesses the data directly through SQL (so its not over the network). The clients would then interface with this service.
How are you accessing the data?
- Well as I said its a SQL server. The system is purely internal (we will design a web interface for clients at a later stage but that will probably use some other web-based authentication which as far as I know will be a lot easier because these things are built into most web development technologies). There is a diginet line that has a VPN to a second office which will probably want access as well.
Where do I want to store users?
We are pretty much ok with anywhere, with 3 restrictions
Can't cost too much, so we should probably use technologies we already have (one of our servers, SQL or something like it)
Management wants security. As much as is possible on our small budget.
Management is a bit touchy about hosting such sensitive data externally, so we pretty much have to own and control where ever it's stored.
How do you want to manage users?
- To be honest I'm not sure what this question is really asking. However I feel like it is important for me to mention here that we are writing a custom app for the business. This app needs to be able to interface seemingly seamlessly with this solution, so the user logs in through our system (which probably uses an API offered by this solution to make calls directly to the system), and this system's authentication controls what access the user has to our custom app.
The more I talk about it the more I think it is a tall order to get some prepackaged solution here, but I keep coming back to what Eric Lippert said:
"Let me give you all my standard caution about rolling your own cryptographic algorithms and security systems: don't."
I'm not qualified to write this properly. It will not be secure. So what is it that people actually do when developing their own software?