Single Sign on for web apps on same box

[Cowboy \(Gregory A. Beamer\)]

Quite a few months back, I was able to create a single sign on app for all
apps on a single box (perhaps a domain, but never tested) by setting the
auth cookie name to an identical value:

<authenticati on mode="Forms">
<forms name="SingleSig nOn" loginUrl="login .aspx">
</authentication>

I could then surf from app to app on the same box and the cookie, named the
same, would allow me to bypass the logon form. I currently have an app in
Framework 1.1, and I get the following:

Default cookie - log into each app, each time, when I bounce from app to app
Cookies with same name - same behavior
Cookies with diff name - log in once to each app, can then surf back and
forth

The actual test code is as follows:

web.config
-----------
<authenticati on mode="Forms">
<forms name="test1" loginUrl="login .aspx" timeout="30"
slidingExpirati on="true" path="/">
<credentials passwordFormat= "Clear">
<user name="Joe" password="passw ord" />
</credentials>
</forms>
</authentication>

<authorizatio n>
<allow users="Joe" /> <!-- Allow all users -->
<deny users="?"></deny>
</authorization>

Login.aspx
-----------
private void LoginButton_Cli ck(object sender, System.EventArg s e)
{
if(FormsAuthent ication.Authent icate(NameText. Text,PasswordTe xt.Text))
{
Session["ID"] = Session.Session ID;
FormsAuthentica tion.RedirectFr omLoginPage("Jo e", false);
}
else
{
BadPasswordLabe l.Text = "This is not a valid login.";
}
}

My thought is either

a) The methodology changed in Framework 1.1
b) I am missing something I had working before

At present, this is not a major issue, but it is something that is bugging
me.

--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

*************** *************** *************** *************** **********
Think Outside the Box!
*************** *************** *************** *************** **********

[Cowboy \(Gregory A. Beamer\)]

If you ever have a problem, post here and your brain will figure it out.

Here is the single sign on using Forms Authentication:

1. Set up the authentication section:

<authenticati on mode="Forms">
<forms name="test1" loginUrl="login .aspx" timeout="30"
slidingExpirati on="true" path="/">
<credentials passwordFormat= "Clear">
<user name="Joe" password="passw ord" />
</credentials>
</forms>
</authentication>

In this case, the password is embedded, but it will actually pull from a
database outside of test.

2. Set up a machine key (this is the missing link in my app):

<machineKey
validationKey=" C50B3C89CB21F4F 1422FF158A5B42D 0E8DB8CB5CDA174 2572A487D9401E3 4
00267682B202B74 6511891C1BAF47F 8D25C07F6C39A10 4696DB51F17C529 AD3CABE"
decryptionKey=" 8A9BE8FD67AF697 9E7D20198CFEA50 DD3D3799C77AF2B 72F"
validation="3DE S"
/>

I nabbed this from a site on the web, but it could have just as easily have
been created. The problem is each application creates its own key, if one is
not specified. In my case, as I bounced from app to app, each app rewrote
the cookie, using its own key. Thus, each new hit on the app, after a hit on
another app, caused re-authentication, as it was reading garbage (wrong
key).

3. Set up app authorization to force logon:

<authorizatio n>
<allow users="Joe" />
<deny users="?">
</authorization>

4. Repeat for additional applications.

Now, I can bounce back and forth without problem.
--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

*************** *************** *************** *************** **********
Think Outside the Box!
*************** *************** *************** *************** **********
"Cowboy (Gregory A. Beamer)" <No************ @comcast.netNoS pamM> wrote in
message news:Or******** ******@tk2msftn gp13.phx.gbl...

Quite a few months back, I was able to create a single sign on app for all
apps on a single box (perhaps a domain, but never tested) by setting the
auth cookie name to an identical value:

<authenticati on mode="Forms">
<forms name="SingleSig nOn" loginUrl="login .aspx">
</authentication>

I could then surf from app to app on the same box and the cookie, named the same, would allow me to bypass the logon form. I currently have an app in
Framework 1.1, and I get the following:

Default cookie - log into each app, each time, when I bounce from app to app Cookies with same name - same behavior
Cookies with diff name - log in once to each app, can then surf back and
forth

The actual test code is as follows:

web.config
-----------
<authenticati on mode="Forms">
<forms name="test1" loginUrl="login .aspx" timeout="30"
slidingExpirati on="true" path="/">
<credentials passwordFormat= "Clear">
<user name="Joe" password="passw ord" />
</credentials>
</forms>
</authentication>

<authorizatio n>
<allow users="Joe" /> <!-- Allow all users -->
<deny users="?"></deny>
</authorization>

Login.aspx
-----------
private void LoginButton_Cli ck(object sender, System.EventArg s e)
{
if(FormsAuthent ication.Authent icate(NameText. Text,PasswordTe xt.Text))
{
Session["ID"] = Session.Session ID;
FormsAuthentica tion.RedirectFr omLoginPage("Jo e", false);
}
else
{
BadPasswordLabe l.Text = "This is not a valid login.";
}
}

My thought is either

a) The methodology changed in Framework 1.1
b) I am missing something I had working before

At present, this is not a major issue, but it is something that is bugging
me.

--
Gregory A. Beamer
MVP; MCP: +I, SE, SD, DBA

*************** *************** *************** *************** **********
Think Outside the Box!
*************** *************** *************** *************** **********