forms authentication ticket .userdata vanishing

[e]

I'm using forms authentication on a site. When the user logs in via the
login page, the entered creds are checked against AD, and if valid, an
encrypted forms authentication ticket is produced and stored in the forms
auth cookie (and written to the client), using this code:
_______________ _____

'create the forms auth ticket

objAuthTicket = New FormsAuthentica tionTicket(1, txtUsername.Tex t, _
DateTime.Now, DateTime.Now.Ad dMinutes(8), False, _
"Data string I want to keep in the Ticket .UserData property")

'encrypt it

strEncryptedTic ket = FormsAuthentica tion.Encrypt(ob jAuthTicket)

'stick it in the forms auth cookie

objAuthCookie = New HttpCookie(Form sAuthentication .FormsCookieNam e, _
strEncryptedTic ket)

'place the cookie on the client

Response.Cookie s.Add(objAuthCo okie)
_______________ _____

If I immediately retreive the cookie using this code:
_______________ _____

'pick up the cookie from the client

objAuthCookie = Request.Cookies (FormsAuthentic ation.FormsCook ieName)

'decrypt/extract the ticket object from the cookie

objAuthTicket = FormsAuthentica tion.Decrypt(ob jAuthCookie.Val ue)
_______________ _____

....and examine the objAuthTicket.U serData, it contains the expected result:

"Data string I want to keep in the Ticket .UserData property"

However in Global.asax, in the Application_Aut henticateReques t event (which
is whre I need to read this ticket data for impersonation & security
purposes), I retreive the cookie (if it exists), decrypt the cookie.Value
into a ticket object using the exact same code as before:
_______________ _____

'pick up the cookie

objAuthCookie = Request.Cookies (FormsAuthentic ation.FormsCook ieName)

'decrypt/extract the ticket object from the cookie

objAuthTicket = FormsAuthentica tion.Decrypt(ob jAuthCookie.Val ue)
_______________ _____

....and examine the objAuthTicket.U serdata, it now contains an unexpected
result:

""

Nothing. The issue date, expiration date, name, isPersistant, all other
aspects of the ticket have correct values, but the userData is now
nullstring. Does anyone have any ideas as to why that is? The login button
click handler and the Application_Aut henticateReques t event are the only 2
places I'm ever touching the cookie in the entire app.

[John Saunders]

"e" <[e-mail]> wrote in message news:G_******** ************@sp eakeasy.net...

I'm using forms authentication on a site. When the user logs in via the
login page, the entered creds are checked against AD, and if valid, an
encrypted forms authentication ticket is produced and stored in the forms
auth cookie (and written to the client), using this code:
_______________ _____

'create the forms auth ticket

objAuthTicket = New FormsAuthentica tionTicket(1, txtUsername.Tex t, _
DateTime.Now, DateTime.Now.Ad dMinutes(8), False, _
"Data string I want to keep in the Ticket .UserData property")

'encrypt it

strEncryptedTic ket = FormsAuthentica tion.Encrypt(ob jAuthTicket)

'stick it in the forms auth cookie

objAuthCookie = New HttpCookie(Form sAuthentication .FormsCookieNam e, _
strEncryptedTic ket)

'place the cookie on the client

Response.Cookie s.Add(objAuthCo okie)
_______________ _____

If I immediately retreive the cookie using this code:
_______________ _____

'pick up the cookie from the client

objAuthCookie = Request.Cookies (FormsAuthentic ation.FormsCook ieName)

'decrypt/extract the ticket object from the cookie

objAuthTicket = FormsAuthentica tion.Decrypt(ob jAuthCookie.Val ue)
_______________ _____

...and examine the objAuthTicket.U serData, it contains the expected result:
"Data string I want to keep in the Ticket .UserData property"

However in Global.asax, in the Application_Aut henticateReques t event (which is whre I need to read this ticket data for impersonation & security
purposes), I retreive the cookie (if it exists), decrypt the cookie.Value
into a ticket object using the exact same code as before:
_______________ _____

'pick up the cookie

objAuthCookie = Request.Cookies (FormsAuthentic ation.FormsCook ieName)

'decrypt/extract the ticket object from the cookie

objAuthTicket = FormsAuthentica tion.Decrypt(ob jAuthCookie.Val ue)
_______________ _____

...and examine the objAuthTicket.U serdata, it now contains an unexpected
result:

""

Nothing. The issue date, expiration date, name, isPersistant, all other
aspects of the ticket have correct values, but the userData is now
nullstring. Does anyone have any ideas as to why that is? The login button click handler and the Application_Aut henticateReques t event are the only 2
places I'm ever touching the cookie in the entire app.

I don't know why your code doesn't work, but in my code, I use the
FormsAuthentica tionTicket directly:

if (!Request.IsAut henticated) return;

FormsIdentity fi = (FormsIdentity) User.Identity;
FormsAuthentica tionTicket ticket = fi.Ticket;
// You can now use ticket.UserData
--
John