Authentication, Redirection and session management with iPlanet/ASP.NET

[Subrata]

I looking for the most efficient solution for the followng scenario, for a
ASP.NET web application:

When the user types in the URL, he's presented with a login page from an
iPlanet server for authenticaiton.
After he's authienticated, the user should be taken to a ASP.NET website
(in IIS), where he can use the application.
Issues: What is the most effecient way of passing user identification infor from the iPlanet to IIS? How you manage session, after the user is authenticated by the iPlanet server and is using the ASP.NET pages in the IIS? The user, potentially, should not be using the ASP.NET app, witout

being authenticated by the iPlanet first. What if he tries to use the URL
for the ASP.NET app directly?

Any help/pointers to the issues are highly appreciated.
Thanks.

[Hans Kesting]

> I looking for the most efficient solution for the followng scenario, for a

ASP.NET web application:

When the user types in the URL, he's presented with a login page from an
iPlanet server for authenticaiton.
After he's authienticated, the user should be taken to a ASP.NET website
(in IIS), where he can use the application.

Issues:

> What is the most effecient way of passing user identification infor

from the iPlanet to IIS?

> How you manage session, after the user is authenticated by the iPlanet

server and is using the ASP.NET pages in the IIS?

> The user, potentially, should not be using the ASP.NET app, witout

being authenticated by the iPlanet first. What if he tries to use the URL for
the ASP.NET app directly?

Any help/pointers to the issues are highly appreciated.
Thanks.

A suggestion:
1) after authentication on iPlanet, store the identity (and possibly a
date) in application-scope, under some newly generated guid.
2) redirect to an "entry page" on IIS, giving that guid as parameter
3) call the iPlanet server directly from code-behind, using that guid
to get the identity. It's an error if there is no identity under that
guid or if that identity is "too old".
4) when you receive an identity, store it in the session
5) if no identity is stored in the (IIS) session, redirect to iPlanet
to log in.

Hans Kesting