FormsAuthentication across applications on differents machines

Discussion in 'ASP .Net Security' started by Portos75, Dec 1, 2005.

  1. Portos75

    Portos75 Guest

    Hello,

    I'm implementing a single sign on for 3 applications in intranet with
    aspnet1.1:

    http://machine1.es.group/App
    http://machine1.es.group/App2
    http://AnotherMachine.es.group/App

    I've read about FormsAuthentication accross aplications and i have in all
    webconfigs the validationkey, decriptionkey, and configured the
    authentication like this:

    <authentication mode="Forms" >
    <forms loginUrl="login.aspx" protection="All" timeout="30" path="/" >
    </forms>

    It works beetwen App and App2 on the same machine but it doesn't work for
    App in the different machine.

    I have tried indicating the domain in the cookie but it doesn't work. Here
    are the code for the login button after validate the user against database:

    HttpCookie oAuthCookie=FormsAuthentication.GetAuthCookie(txtUser.Text, false);
    oAuthCookie.Domain="es.group";
    Response.AppendCookie(oAuthCookie);

    String sRedirectUrl=FormsAuthentication.GetRedirectUrl(txtUser.Text,
    chkPersistent.Checked);
    Response.Redirect(sRedirectUrl, false);

    I've tried to verify the domain of the cookie with this code but the domain
    property is always empty.

    String sRet =null;

    HttpCookie oCookie=null;
    // cookies
    for (Int32 i=0; i< Request.Cookies.Count; i++)
    {
    oCookie=Request.Cookies;
    sRet += String.Format("<BR>{0}, Domain=[{1}], Path=[{2}], Expires=[{3}],
    Secure=[{4}] ", oCookie.Name, oCookie.Domain, oCookie.Path, oCookie.Expires,
    oCookie.Secure);
    }

    Any ideas?
    Portos75, Dec 1, 2005
    #1
    1. Advertising

  2. Hello Portos75,

    you have to "instruct" IE to send the auth cookie to another machine that
    were the cookie originally came from - the the domain property of the cookie
    to

    ".es.group"

    ---------------------------------------
    Dominick Baier - DevelopMentor
    http://www.leastprivilege.com

    > Hello,
    >
    > I'm implementing a single sign on for 3 applications in intranet with
    > aspnet1.1:
    >
    > http://machine1.es.group/App
    > http://machine1.es.group/App2
    > http://AnotherMachine.es.group/App
    > I've read about FormsAuthentication accross aplications and i have in
    > all webconfigs the validationkey, decriptionkey, and configured the
    > authentication like this:
    >
    > <authentication mode="Forms" >
    > <forms loginUrl="login.aspx" protection="All" timeout="30"
    > path="/" >
    > </forms>
    > It works beetwen App and App2 on the same machine but it doesn't work
    > for App in the different machine.
    >
    > I have tried indicating the domain in the cookie but it doesn't work.
    > Here are the code for the login button after validate the user against
    > database:
    >
    > HttpCookie oAuthCookie=FormsAuthentication.GetAuthCookie(txtUser.Text,
    > false);
    > oAuthCookie.Domain="es.group";
    > Response.AppendCookie(oAuthCookie);
    > String sRedirectUrl=FormsAuthentication.GetRedirectUrl(txtUser.Text,
    > chkPersistent.Checked);
    > Response.Redirect(sRedirectUrl, false);
    > I've tried to verify the domain of the cookie with this code but the
    > domain property is always empty.
    >
    > String sRet =null;
    >
    > HttpCookie oCookie=null;
    > // cookies
    > for (Int32 i=0; i< Request.Cookies.Count; i++)
    > {
    > oCookie=Request.Cookies;
    > sRet += String.Format("<BR>{0}, Domain=[{1}], Path=[{2}],
    > Expires=[{3}],
    > Secure=[{4}] ", oCookie.Name, oCookie.Domain, oCookie.Path,
    > oCookie.Expires,
    > oCookie.Secure);
    > }
    > Any ideas?
    >
    Dominick Baier [DevelopMentor], Dec 1, 2005
    #2
    1. Advertising

  3. Portos75

    Portos75 Guest

    Hello Dominick,

    I have already tried to do that like I have said in my last message.
    Maybe I'm doing something wrong.

    Have you seen the code of my last message? Am I doing something wrong?
    How should I do that?
    Dou you know why When I get the domain from the cookie is always empty?

    I have tried to insert a point before es.group as you "comment" in your post
    but it does'nt work too.

    Thanks in advance,

    "Dominick Baier [DevelopMentor]" wrote:

    > Hello Portos75,
    >
    > you have to "instruct" IE to send the auth cookie to another machine that
    > were the cookie originally came from - the the domain property of the cookie
    > to
    >
    > ".es.group"
    >
    > ---------------------------------------
    > Dominick Baier - DevelopMentor
    > http://www.leastprivilege.com
    >
    > > Hello,
    > >
    > > I'm implementing a single sign on for 3 applications in intranet with
    > > aspnet1.1:
    > >
    > > http://machine1.es.group/App
    > > http://machine1.es.group/App2
    > > http://AnotherMachine.es.group/App
    > > I've read about FormsAuthentication accross aplications and i have in
    > > all webconfigs the validationkey, decriptionkey, and configured the
    > > authentication like this:
    > >
    > > <authentication mode="Forms" >
    > > <forms loginUrl="login.aspx" protection="All" timeout="30"
    > > path="/" >
    > > </forms>
    > > It works beetwen App and App2 on the same machine but it doesn't work
    > > for App in the different machine.
    > >
    > > I have tried indicating the domain in the cookie but it doesn't work.
    > > Here are the code for the login button after validate the user against
    > > database:
    > >
    > > HttpCookie oAuthCookie=FormsAuthentication.GetAuthCookie(txtUser.Text,
    > > false);
    > > oAuthCookie.Domain="es.group";
    > > Response.AppendCookie(oAuthCookie);
    > > String sRedirectUrl=FormsAuthentication.GetRedirectUrl(txtUser.Text,
    > > chkPersistent.Checked);
    > > Response.Redirect(sRedirectUrl, false);
    > > I've tried to verify the domain of the cookie with this code but the
    > > domain property is always empty.
    > >
    > > String sRet =null;
    > >
    > > HttpCookie oCookie=null;
    > > // cookies
    > > for (Int32 i=0; i< Request.Cookies.Count; i++)
    > > {
    > > oCookie=Request.Cookies;
    > > sRet += String.Format("<BR>{0}, Domain=[{1}], Path=[{2}],
    > > Expires=[{3}],
    > > Secure=[{4}] ", oCookie.Name, oCookie.Domain, oCookie.Path,
    > > oCookie.Expires,
    > > oCookie.Secure);
    > > }
    > > Any ideas?
    > >

    >
    >
    >
    Portos75, Dec 5, 2005
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. aa
    Replies:
    1
    Views:
    304
    Curt_C [MVP]
    Jul 12, 2004
  2. Ricardo Garcia

    about differents encodings

    Ricardo Garcia, Oct 5, 2004, in forum: XML
    Replies:
    2
    Views:
    375
    Martin Honnen
    Oct 5, 2004
  3. john
    Replies:
    3
    Views:
    370
    john fra
    Aug 10, 2006
  4. Jean-Claude Arbaut

    Multiple declarations in differents files

    Jean-Claude Arbaut, Jun 18, 2005, in forum: C Programming
    Replies:
    4
    Views:
    280
    Jean-Claude Arbaut
    Jun 19, 2005
  5. Replies:
    3
    Views:
    360
    CBFalconer
    Jul 5, 2005
Loading...

Share This Page