M
Mike
We are looking into developing a portal site which will consist of a number of web applications. For the purposes of authentication, MS Passport seems to be a good candidate for a number of reasons, not least of which is that Passport authentication is well catered for in ASP.Net
However, one of our customers has devised a custom authentication mechanism which works as follows (with one of our existing apps)
1. The user is already logged in to the customer's Extrane
2. To login to our application, an http request is made to a specific page in our application with a random authentication key parameter supplied in the query strin
3. We make a call to the customer's authentication service (a web page) using the ke
4. Some XML is returned, including the user nam
5. Using the user name, we cross-reference it to a user account in our application and log him i
We can assume that at point 4 we have an authentic user name. Via a db lookup we could infer an MS Passport account name or ID, e.g. (e-mail address removed). But, is there any way that we can persuade our ASP.Net application that this user is logged into Passport? It would be a pity if we couldn't use <authentication mode="Passport"> just because of one customer!
However, one of our customers has devised a custom authentication mechanism which works as follows (with one of our existing apps)
1. The user is already logged in to the customer's Extrane
2. To login to our application, an http request is made to a specific page in our application with a random authentication key parameter supplied in the query strin
3. We make a call to the customer's authentication service (a web page) using the ke
4. Some XML is returned, including the user nam
5. Using the user name, we cross-reference it to a user account in our application and log him i
We can assume that at point 4 we have an authentic user name. Via a db lookup we could infer an MS Passport account name or ID, e.g. (e-mail address removed). But, is there any way that we can persuade our ASP.Net application that this user is logged into Passport? It would be a pity if we couldn't use <authentication mode="Passport"> just because of one customer!