Single signon (with FormsAuth) for mutliple web apps

Discussion in 'ASP .Net Security' started by Brad, Sep 24, 2003.

  1. Brad

    Brad Guest

    I'm working on single signon for multiple web apps on a single domain. If I
    authenticate in wepApp1 then I am authenticated in webApp2 however, anywhere
    in the global.asax code of webApp2 the following don't seem to be
    set/initialized:
    Request.IsAuthenticated
    User.Identity
    The authentication cookie is available in webApp2's global.asax and once
    a form is loaded (i.e. I'm on a pageload event) the values of
    Request.IsAuthenticated and User.Identity are available.

    So why would the values of user identity and IsAuthenticated not be
    avaialble in the global.asax of webApp2?


    Thanks


    Brad
     
    Brad, Sep 24, 2003
    #1
    1. Advertising

  2. In terms of your code, both of your assemblies (one for each we application)
    are completely separate. One assembly doesn't get to read from the other,
    even though they are in the same App Domain. The ability to read the cookie
    by both essentially serves as the cross-assembly communication mechanism
    (visualize it as serving a similar function to named pipes); others are
    available, but this is probably the easiest.

    One solution I have implemented is to create a custom logon page that looks
    for a cookie that indicates authentication. If I find a valid cookie, then I
    go ahead and set up that user as authenticated and return to the page that
    requested the authentication. If I don't, then I display the page as normal
    and have them enter their user/pass.

    --
    Chris Jackson
    Software Engineer
    Microsoft MVP - Windows XP
    Windows XP Associate Expert
    --
    "Brad" <> wrote in message
    news:%...
    > I'm working on single signon for multiple web apps on a single domain. If

    I
    > authenticate in wepApp1 then I am authenticated in webApp2 however,

    anywhere
    > in the global.asax code of webApp2 the following don't seem to be
    > set/initialized:
    > Request.IsAuthenticated
    > User.Identity
    > The authentication cookie is available in webApp2's global.asax and

    once
    > a form is loaded (i.e. I'm on a pageload event) the values of
    > Request.IsAuthenticated and User.Identity are available.
    >
    > So why would the values of user identity and IsAuthenticated not be
    > avaialble in the global.asax of webApp2?
    >
    >
    > Thanks
    >
    >
    > Brad
    >
    >
    >
     
    Chris Jackson, Sep 25, 2003
    #2
    1. Advertising

  3. Brad

    Brad Guest

    I found the problem....basicaly a brain lapse on my part after being away
    from hands-on coding for a few months.
    I can access the authentication info just fine but I need to do it in
    Application_AuthenticateRequest. Once I did that then everything works as I
    expected: Identity is avaialble and IsAuthenticated is true is the user is
    logged in.
    Brad


    "Chris Jackson" <> wrote in message
    news:...
    > In terms of your code, both of your assemblies (one for each we

    application)
    > are completely separate. One assembly doesn't get to read from the other,
    > even though they are in the same App Domain. The ability to read the

    cookie
    > by both essentially serves as the cross-assembly communication mechanism
    > (visualize it as serving a similar function to named pipes); others are
    > available, but this is probably the easiest.
    >
    > One solution I have implemented is to create a custom logon page that

    looks
    > for a cookie that indicates authentication. If I find a valid cookie, then

    I
    > go ahead and set up that user as authenticated and return to the page that
    > requested the authentication. If I don't, then I display the page as

    normal
    > and have them enter their user/pass.
    >
    > --
    > Chris Jackson
    > Software Engineer
    > Microsoft MVP - Windows XP
    > Windows XP Associate Expert
    > --
    > "Brad" <> wrote in message
    > news:%...
    > > I'm working on single signon for multiple web apps on a single domain.

    If
    > I
    > > authenticate in wepApp1 then I am authenticated in webApp2 however,

    > anywhere
    > > in the global.asax code of webApp2 the following don't seem to be
    > > set/initialized:
    > > Request.IsAuthenticated
    > > User.Identity
    > > The authentication cookie is available in webApp2's global.asax and

    > once
    > > a form is loaded (i.e. I'm on a pageload event) the values of
    > > Request.IsAuthenticated and User.Identity are available.
    > >
    > > So why would the values of user identity and IsAuthenticated not be
    > > avaialble in the global.asax of webApp2?
    > >
    > >
    > > Thanks
    > >
    > >
    > > Brad
    > >
    > >
    > >

    >
    >
     
    Brad, Sep 26, 2003
    #3
  4. Hi Brad,

    I am glad to know that the problem is resolved.

    Thank you very much for sharing your solution. It is helpful to everybody
    here.

    Best regards,

    Jacob Yang
    Microsoft Online Partner Support
    Get Secure! ┬ĘC www.microsoft.com/security
    This posting is provided "as is" with no warranties and confers no rights.
     
    Jacob Yang [MSFT], Sep 26, 2003
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. =?Utf-8?B?UG9ueSBUc3Vp?=

    how to single signon two .net 2.0 websites?

    =?Utf-8?B?UG9ueSBUc3Vp?=, Apr 12, 2006, in forum: ASP .Net
    Replies:
    1
    Views:
    2,493
    Steven Cheng[MSFT]
    Apr 12, 2006
  2. Replies:
    0
    Views:
    377
  3. polilop
    Replies:
    2
    Views:
    999
    polilop
    May 3, 2008
  4. Phillip Jubb
    Replies:
    1
    Views:
    154
    Daniel Fisher\(lennybacon\)
    Dec 13, 2004
  5. ela
    Replies:
    12
    Views:
    381
    Uri Guttman
    Apr 6, 2009
Loading...

Share This Page