Form Authentication with Remote Login.aspx

Beginner

I know this is an old question, but searching all over the internet plus
several MS security conferences, still haven't got a straight anwser.

Basically, the login.aspx is on one dedicated server in the domain using AD.
ASP.NET applications run on other servers (not neccessary in domain) and
trying to use authentication server. How could this be done?

- Most response says you need to set MachineKey the same, but that alone
doesn't seem enough
- There's one article says the login.aspx needs to set a third-party cookie
for the requester in order for them to retrieve (sounds reasonable, any
examples?) Any workaround if not so sure about browser privacy settings?

Anyway, the goal is have a central .NET based form authentication for all
our intra-net web applications.

Thanks.

Nov 18 '05 #1

Subscribe Reply

2782

bruce barker

you need to decide how login info is passed from the login server to the
application servers. lets pick a guid.

1) the application logon page redirects the login server to login in.
2) the login server validates the login with AD and assigns a login guid
3) the login server store the login guid, and associated roles in its
session cache
4) the login server redirects back to the application site's logon page
passing the guid in the url or cookie (using a cookie will require the
login server and application servers have a common dns root)
5) the application site retrieves the login guid from the url or cookie
6) the application site calls the login server passing the guid to get the
login creditals (the application server should pass some verification data
to prove who it is - maybe a certificate - or a special login).
7) the application site builds a login ticket with the login creditals.
8) the application site redirects back to the originally requested page.

-- bruce (sqlwork.com)

"Beginner" <bz****@hotmail .com> wrote in message
news:ON******** ******@TK2MSFTN GP12.phx.gbl...

I know this is an old question, but searching all over the internet plus
several MS security conferences, still haven't got a straight anwser.

Basically, the login.aspx is on one dedicated server in the domain using AD. ASP.NET applications run on other servers (not neccessary in domain) and
trying to use authentication server. How could this be done?

- Most response says you need to set MachineKey the same, but that alone
doesn't seem enough
- There's one article says the login.aspx needs to set a third-party cookie for the requester in order for them to retrieve (sounds reasonable, any
examples?) Any workaround if not so sure about browser privacy settings?

Anyway, the goal is have a central .NET based form authentication for all
our intra-net web applications.

Thanks.

Nov 18 '05 #2

Beginner

Sounds pretty interesting. I'll give it a try.

Thank you very much.

"bruce barker" <no***********@ safeco.com> wrote in message
news:OB******** ******@TK2MSFTN GP09.phx.gbl...

you need to decide how login info is passed from the login server to the
application servers. lets pick a guid.

1) the application logon page redirects the login server to login in.
2) the login server validates the login with AD and assigns a login guid
3) the login server store the login guid, and associated roles in its
session cache
4) the login server redirects back to the application site's logon page
passing the guid in the url or cookie (using a cookie will require the
login server and application servers have a common dns root)
5) the application site retrieves the login guid from the url or cookie
6) the application site calls the login server passing the guid to get the
login creditals (the application server should pass some verification data
to prove who it is - maybe a certificate - or a special login).
7) the application site builds a login ticket with the login creditals.
8) the application site redirects back to the originally requested page.

-- bruce (sqlwork.com)

"Beginner" <bz****@hotmail .com> wrote in message
news:ON******** ******@TK2MSFTN GP12.phx.gbl...
I know this is an old question, but searching all over the internet plus
several MS security conferences, still haven't got a straight anwser.

Basically, the login.aspx is on one dedicated server in the domain using

AD.
ASP.NET applications run on other servers (not neccessary in domain) and
trying to use authentication server. How could this be done?

- Most response says you need to set MachineKey the same, but that alone
doesn't seem enough
- There's one article says the login.aspx needs to set a third-party

cookie
for the requester in order for them to retrieve (sounds reasonable, any
examples?) Any workaround if not so sure about browser privacy settings?
Anyway, the goal is have a central .NET based form authentication for all our intra-net web applications.

Thanks.

Nov 18 '05 #3

Similar topics

4637

forms authentication with loginurl on a remote machine

by: Hermit Dave | last post by:

Hi, I am making a web application (rather two applications) one which is host and used by customers when they are just browsing through products. The second application resides on a secure server. This is going to hold all account related information for the customers and will also be used for admin The login is implemented using forms authentication and i was just reading up about that... but as everyone already knows.... its all...

ASP.NET

2333

Forms Authentication - Pass String to Login Form

by: David Krussow | last post by:

Just wondering if/how it would be possible to display a variable string on the login form - where the string varies depending on the form the user attempted to access. To clarify, an unauthenticated user is browsing the site, and tries to open the UltraSecretContent.aspx page. Forms authentication automatically redirects the user to login.aspx. I would like for login.aspx to display a message that reads, "You must log in before viewing...

ASP.NET

2970

by: David W. Simmonds | last post by:

I have a form that will prompt for a user name/password. In VS.NET, I have the protected form in a folder named Admin. I have a Web.config file in that folder as well. It contains the following section: <authorization> <deny users="?" /> <allow users="*" /> </authorization> In the root folder where the other forms are located I have a Web.config

ASP.NET

2908

Urgent - need help with logging anonymous and Active Dir users without login form

by: pv | last post by:

Hi everyone, I need help with following scenario, please: Users are accessing same web server from intranet (users previously authenticated in Active Dir) and from extranet (common public users). If user is from intranet, web server should recognize it and application should create additional options in controls regarding groups the user belongs to. If user is from extranet it should be logged in as anonymous and a link to login page...

ASP.NET

2793

using forms or windows authentication for Login in MSSql Server(integratedsecurity)

by: sefe dery | last post by:

Hi ng, i have an Asp.net webapplication on a remote Windows Server 2003. I created on the remote server a windows account and i use the "only windows authentification" in sql server 2000. The name and passwort for the windows account are the same like the credentials in asp.net.

ASP.NET

1748

Form based authentication for a web aplication in subdirectory

by: sivam.solai | last post by:

hai i have My Asp.net Project in C:\AspNetproject AspNetproject have To sub Folder. 1) Forums and 2) users Exe : C:\AspNetproject\Fourms Exe : C:\AspNetproject:\users The Fourms Foldder Having Topic.aspx,startThread.aspx , Replay.aspx

ASP.NET

3079

Form authentication and html files

by: nick | last post by:

I have an Asp.Net 2.0 application using form authentication. I want the html pages be protected by the authentication system too. The accessing of html files need to be authenticated in my local system. However, it doesn't after I uploaded the files to my web host site. Any setting to modify to make my hosting html files need to be authenticated too?

ASP.NET

1489

Custom Authentication without Server

by: Rudi Hausmann | last post by:

Hi, I want to implement my own "primitive" Authentication. I use following code in web.config: <authentication mode="Forms"> <forms name="FwLoginCookie" loginUrl="Login.aspx" protection="All" timeout="30"

ASP.NET

1460

by: sandari | last post by:

The following code (web.config in Visual Studio 2005) is supposed to redirect a user to the appropriate Form depending on their role. However, regardless of the user's role, the only page displayed is the login page with the URL of the page the user was supposed to go to being displayed in the address bar. A valid user is: name "sandy" password = san_mcd role = Administrator ...

.NET Framework

8832

Changing the language in Windows 10

by: Hystou | last post by:

Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...

Windows Server

9566

Problem With Comparison Operator <=> in G++

by: Oralloy | last post by:

Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...

C / C++

9388

Maximizing Business Potential: The Nexus of Website Design and Digital Marketing

by: jinu1996 | last post by:

In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven tapestry of website design and digital marketing. It's not merely about having a website; it's about crafting an immersive digital experience that captivates audiences and drives business growth. The Art of Business Website Design Your website is...

Online Marketing

9333

The easy way to turn off automatic updates for Windows 10/11

by: Hystou | last post by:

Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...

Windows Server

8256

AI Job Threat for Devs

by: agi2029 | last post by:

Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...

Career Advice

6800

Access Europe - Using VBA to create a class based on a table - Wed 1 May

by: isladogs | last post by:

The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...

Microsoft Access / VBA

6078

Couldn’t get equations in html when convert word .docx file to html file in C#.

by: conductexam | last post by:

I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...

C# / C Sharp

3319

transfer the data from one system to another through ip address

by: 6302768590 | last post by:

Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system

C# / C Sharp

2217

Comprehensive Guide to Website Development in Toronto: Expert Insights from BSMN Consultancy

by: bsmnconsultancy | last post by:

In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

General