c# forms authentication

[code]

Hi,

I have stumbled across an interesting problem regarding forms
authentication over multiple sub domains. The topic has been covered in
various forms online but never really gets a definitive answer as to
why it happens.

I have two separate web apps sat on different sub domains of the same
company realm. eg:

http://auth.company.co.uk
http://work.company.co.uk

The auth domain is a very simple app for handling single sign on across
multiple sub domains. The work domain is an example of a consuming web
app that needs to use the authentication service of auth.

I have configured the work domain to deny all users by forms
authentication, which points to a login form on the auth domain
(http://auth.company.co.uk/login.aspx). When a user hits the work
domain, they are redirected to auth and they can log in.

The problem occurs after the auto redirect, which happens when the
framework determines that the current request is not authenticated. The
query string param 'RedirectUrl' is appended to the login url but it
does not include the absolute path and hence the originating domain.
Once the user authenticates, forms authentication only has
'/<originalrequest>' as the redirect url so tries to redirect within
the auth domain. This page does not exist and an error occurs.

A solution is to set a cookie in every consuming web app that stores
the sub domain value of the previously executing request. The auth web
app can then inspect this sub domain value and include it in the
redirect once a user has logged in. This would work fine but ideally I
want to find a different solution that does not rely on cookies - as in
the mobile forms authentication approach where an authentication ticket
will be appended as a querystring parameter if the mobile device does
not support cookie based redirects.

Any assistance would be greatly appreciated.

Many thanks

 

[bcutting]

Maintaining Forms authenitcation across subdomains is tricky.
I would create a login page in work and have it do nothing but redirect
to the auth login page with the correct redirection URL in the query
string. Then do the authentication and redirect back.

If using cookies make sure cookiename is the same across both domains
and set the forms auth cookie domain as the base domain.
In web.config <machineKey validationKey="<MyValKey>"
decryptionKey="<MyDecryptKey>" validation="SHA1"/>, you will need to
generate your own keys and explicitly define them, ontherwise everytime
you reinstall the virtual directory they will be recreated and
different across sites.

I have never done it without cookies, however I would guess as long you
handle querystring properly then it should work. One thing to note is
to make sure you handle sessionstate and authentication/authorization
completely seperate since you are spanning two session states.

Hope this helps,
Endo

 

[code]

Thanks Endo for your response, much appreciated.

It all works at the moment but I think I will investigate your
suggestion of a login page for each sub site.

Webservice option also working.

Cheers