473,546 Members | 2,214 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Form Authentication with Remote Login.aspx

I know this is an old question, but searching all over the internet plus
several MS security conferences, still haven't got a straight anwser.

Basically, the login.aspx is on one dedicated server in the domain using AD.
ASP.NET applications run on other servers (not neccessary in domain) and
trying to use authentication server. How could this be done?

- Most response says you need to set MachineKey the same, but that alone
doesn't seem enough
- There's one article says the login.aspx needs to set a third-party cookie
for the requester in order for them to retrieve (sounds reasonable, any
examples?) Any workaround if not so sure about browser privacy settings?

Anyway, the goal is have a central .NET based form authentication for all
our intra-net web applications.

Thanks.


Nov 18 '05 #1
2 2768
you need to decide how login info is passed from the login server to the
application servers. lets pick a guid.

1) the application logon page redirects the login server to login in.
2) the login server validates the login with AD and assigns a login guid
3) the login server store the login guid, and associated roles in its
session cache
4) the login server redirects back to the application site's logon page
passing the guid in the url or cookie (using a cookie will require the
login server and application servers have a common dns root)
5) the application site retrieves the login guid from the url or cookie
6) the application site calls the login server passing the guid to get the
login creditals (the application server should pass some verification data
to prove who it is - maybe a certificate - or a special login).
7) the application site builds a login ticket with the login creditals.
8) the application site redirects back to the originally requested page.

-- bruce (sqlwork.com)


"Beginner" <bz****@hotmail .com> wrote in message
news:ON******** ******@TK2MSFTN GP12.phx.gbl...
I know this is an old question, but searching all over the internet plus
several MS security conferences, still haven't got a straight anwser.

Basically, the login.aspx is on one dedicated server in the domain using AD. ASP.NET applications run on other servers (not neccessary in domain) and
trying to use authentication server. How could this be done?

- Most response says you need to set MachineKey the same, but that alone
doesn't seem enough
- There's one article says the login.aspx needs to set a third-party cookie for the requester in order for them to retrieve (sounds reasonable, any
examples?) Any workaround if not so sure about browser privacy settings?

Anyway, the goal is have a central .NET based form authentication for all
our intra-net web applications.

Thanks.

Nov 18 '05 #2
Sounds pretty interesting. I'll give it a try.

Thank you very much.

"bruce barker" <no***********@ safeco.com> wrote in message
news:OB******** ******@TK2MSFTN GP09.phx.gbl...
you need to decide how login info is passed from the login server to the
application servers. lets pick a guid.

1) the application logon page redirects the login server to login in.
2) the login server validates the login with AD and assigns a login guid
3) the login server store the login guid, and associated roles in its
session cache
4) the login server redirects back to the application site's logon page
passing the guid in the url or cookie (using a cookie will require the
login server and application servers have a common dns root)
5) the application site retrieves the login guid from the url or cookie
6) the application site calls the login server passing the guid to get the
login creditals (the application server should pass some verification data
to prove who it is - maybe a certificate - or a special login).
7) the application site builds a login ticket with the login creditals.
8) the application site redirects back to the originally requested page.

-- bruce (sqlwork.com)


"Beginner" <bz****@hotmail .com> wrote in message
news:ON******** ******@TK2MSFTN GP12.phx.gbl...
I know this is an old question, but searching all over the internet plus
several MS security conferences, still haven't got a straight anwser.

Basically, the login.aspx is on one dedicated server in the domain using

AD.
ASP.NET applications run on other servers (not neccessary in domain) and
trying to use authentication server. How could this be done?

- Most response says you need to set MachineKey the same, but that alone
doesn't seem enough
- There's one article says the login.aspx needs to set a third-party

cookie
for the requester in order for them to retrieve (sounds reasonable, any
examples?) Any workaround if not so sure about browser privacy settings?
Anyway, the goal is have a central .NET based form authentication for all our intra-net web applications.

Thanks.


Nov 18 '05 #3

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

9
4615
by: Hermit Dave | last post by:
Hi, I am making a web application (rather two applications) one which is host and used by customers when they are just browsing through products. The second application resides on a secure server. This is going to hold all account related information for the customers and will also be used for admin The login is implemented using forms...
4
2314
by: David Krussow | last post by:
Just wondering if/how it would be possible to display a variable string on the login form - where the string varies depending on the form the user attempted to access. To clarify, an unauthenticated user is browsing the site, and tries to open the UltraSecretContent.aspx page. Forms authentication automatically redirects the user to...
11
2944
by: David W. Simmonds | last post by:
I have a form that will prompt for a user name/password. In VS.NET, I have the protected form in a folder named Admin. I have a Web.config file in that folder as well. It contains the following section: <authorization> <deny users="?" /> <allow users="*" /> </authorization> In the root folder where the other forms are located I have a...
2
2887
by: pv | last post by:
Hi everyone, I need help with following scenario, please: Users are accessing same web server from intranet (users previously authenticated in Active Dir) and from extranet (common public users). If user is from intranet, web server should recognize it and application should create additional options in controls regarding groups the user...
1
2784
by: sefe dery | last post by:
Hi ng, i have an Asp.net webapplication on a remote Windows Server 2003. I created on the remote server a windows account and i use the "only windows authentification" in sql server 2000. The name and passwort for the windows account are the same like the credentials in asp.net.
1
1740
by: sivam.solai | last post by:
hai i have My Asp.net Project in C:\AspNetproject AspNetproject have To sub Folder. 1) Forums and 2) users Exe : C:\AspNetproject\Fourms Exe : C:\AspNetproject:\users The Fourms Foldder Having Topic.aspx,startThread.aspx , Replay.aspx
2
3072
by: nick | last post by:
I have an Asp.Net 2.0 application using form authentication. I want the html pages be protected by the authentication system too. The accessing of html files need to be authenticated in my local system. However, it doesn't after I uploaded the files to my web host site. Any setting to modify to make my hosting html files need to be...
7
1481
by: Rudi Hausmann | last post by:
Hi, I want to implement my own "primitive" Authentication. I use following code in web.config: <authentication mode="Forms"> <forms name="FwLoginCookie" loginUrl="Login.aspx" protection="All" timeout="30"
0
1450
by: sandari | last post by:
The following code (web.config in Visual Studio 2005) is supposed to redirect a user to the appropriate Form depending on their role. However, regardless of the user's role, the only page displayed is the login page with the URL of the page the user was supposed to go to being displayed in the address bar. A valid user is: ...
0
7435
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language...
0
7698
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. ...
1
7461
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For...
0
7794
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the...
0
6030
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then...
1
5361
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes...
0
5080
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert...
0
3472
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
1922
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.