We have a TabletPC application used by remote, roaming users who only have
Internet access. We would like to place the deployment site on our Internet
so they will be able to apply updates, however the issue of security for
ClickOnce seems not to have been considered by Microsoft for some odd reason
(considering that Microsoft has, in theory, become so security conscience
these days). For example, we would like the users to be authenticated prior
to applying updates. This can be somewhat dicey because we do not have AD
for our internal network users in the DMZ, even if it could be done at all
(which appears to not be the case).

Has anyone faced this issue and, if so, how did you go about solving it?

Re: ClickOnce deployment security on the Internet by Robbe

Robbe
Mon Jun 12 19:03:24 CDT 2006

Nope, we use AD to enforce this stuff. That said,
if you open up the default.htm generated by
clickonce, you'll see it ain't doing a whole lot.

You could easily do away with default.htm
and replace it with a .asp or .aspx page
that incorporates your own authentication.

You'd have to tweak stuff to hide the folders and
files. But, it could definitely be done.

P.S. I think MS is really heavily on AD if
you want something like this locked down.

You could also make the site only accessible
from inside your network.

--
Robbe Morris - 2004-2006 Microsoft MVP C#
Earn money answering .NET questions
http://www.eggheadcafe.com/forums/merit.asp





"Thirsty Traveler" <nfr@nospam.com> wrote in message
news:uUnPX6jjGHA.3588@TK2MSFTNGP02.phx.gbl...
> We have a TabletPC application used by remote, roaming users who only have
> Internet access. We would like to place the deployment site on our
> Internet so they will be able to apply updates, however the issue of
> security for ClickOnce seems not to have been considered by Microsoft for
> some odd reason (considering that Microsoft has, in theory, become so
> security conscience these days). For example, we would like the users to
> be authenticated prior to applying updates. This can be somewhat dicey
> because we do not have AD for our internal network users in the DMZ, even
> if it could be done at all (which appears to not be the case).
>
> Has anyone faced this issue and, if so, how did you go about solving it?
>



Re: ClickOnce deployment security on the Internet by Thirsty

Thirsty
Tue Jun 13 10:13:31 CDT 2006

I would prefer to limit it to the inside network, but unfortunetly our
TabletPC's are being used by remote staff throughout the country. For SOX
reasons, we are not allowed to give them VPN access to our internal network.

"Robbe Morris [C# MVP]" <info@eggheadcafe.com> wrote in message
news:uP5u%23wnjGHA.4504@TK2MSFTNGP03.phx.gbl...
> Nope, we use AD to enforce this stuff. That said,
> if you open up the default.htm generated by
> clickonce, you'll see it ain't doing a whole lot.
>
> You could easily do away with default.htm
> and replace it with a .asp or .aspx page
> that incorporates your own authentication.
>
> You'd have to tweak stuff to hide the folders and
> files. But, it could definitely be done.
>
> P.S. I think MS is really heavily on AD if
> you want something like this locked down.
>
> You could also make the site only accessible
> from inside your network.
>
> --
> Robbe Morris - 2004-2006 Microsoft MVP C#
> Earn money answering .NET questions
> http://www.eggheadcafe.com/forums/merit.asp
>
>
>
>
>
> "Thirsty Traveler" <nfr@nospam.com> wrote in message
> news:uUnPX6jjGHA.3588@TK2MSFTNGP02.phx.gbl...
>> We have a TabletPC application used by remote, roaming users who only
>> have Internet access. We would like to place the deployment site on our
>> Internet so they will be able to apply updates, however the issue of
>> security for ClickOnce seems not to have been considered by Microsoft for
>> some odd reason (considering that Microsoft has, in theory, become so
>> security conscience these days). For example, we would like the users to
>> be authenticated prior to applying updates. This can be somewhat dicey
>> because we do not have AD for our internal network users in the DMZ, even
>> if it could be done at all (which appears to not be the case).
>>
>> Has anyone faced this issue and, if so, how did you go about solving it?
>>
>
>



Re: ClickOnce deployment security on the Internet by Andy

Andy
Wed Jun 14 13:34:04 CDT 2006

Thirsty Traveler wrote:
> I would prefer to limit it to the inside network, but unfortunetly our
> TabletPC's are being used by remote staff throughout the country. For SOX
> reasons, we are not allowed to give them VPN access to our internal network.

I have to ask; what specifically in SOX disallows you from giving VPN
access to your internal network? It would seem rather odd that SOX
suddenly makes the use of VPN illegal...


Re: ClickOnce deployment security on the Internet by Thirsty

Thirsty
Thu Jun 15 14:18:46 CDT 2006

It is not illegal, but VPN access is tightly controlled and much more
difficult to get approval.

"Andy" <ajj3085@alum.rit.edu> wrote in message
news:1150310043.903840.4480@c74g2000cwc.googlegroups.com...
> Thirsty Traveler wrote:
>> I would prefer to limit it to the inside network, but unfortunetly our
>> TabletPC's are being used by remote staff throughout the country. For SOX
>> reasons, we are not allowed to give them VPN access to our internal
>> network.
>
> I have to ask; what specifically in SOX disallows you from giving VPN
> access to your internal network? It would seem rather odd that SOX
> suddenly makes the use of VPN illegal...
>