Web apps x 2 - Sharing session

[Steven Nagy]

Hey all,

Is it possible that I can somehow transfer an authenticated user
(stored in session) between 2 web applications with some measure of
security? Essentially if a user has logged into application A, I want
to somewhat integrate pages from application B, but the user will need
to be authenticated to application B. In application B, the user will
need to be stored in session also.

Configuring web servers and so on is not much of an option here. I need
an in code solution.
Perhaps application B can have some sort of ASPX that deals with
requests for authenticating a user. Application A could pass username
and password to App B via this page as a POST and then app B will store
user in session. Then app A can call pages from app B wherever they
like. The only thing I would need to manage is if the session on App B
has expired, and if so, to re-authenticate as necessary. This was only
my first "guess" at a possible solution and am open to any suggestions.
Cheers,
Steven

[Shawn Wildermuth (C# MVP)]

Hello Steven,

Yes, but they must share session keys and authentication keys. There are
a number of articles that talk about how setup a machine key for each virtual
directory to enable sharing of the session tokens. Google it.
Thanks,
Shawn Wildermuth
Speaker, Author and C# MVP
http://adoguy.com

Hey all,

Is it possible that I can somehow transfer an authenticated user
(stored in session) between 2 web applications with some measure of
security? Essentially if a user has logged into application A, I want
to somewhat integrate pages from application B, but the user will need
to be authenticated to application B. In application B, the user will
need to be stored in session also.

Configuring web servers and so on is not much of an option here. I
need
an in code solution.
Perhaps application B can have some sort of ASPX that deals with
requests for authenticating a user. Application A could pass username
and password to App B via this page as a POST and then app B will
store
user in session. Then app A can call pages from app B wherever they
like. The only thing I would need to manage is if the session on App B
has expired, and if so, to re-authenticate as necessary. This was only
my first "guess" at a possible solution and am open to any
suggestions.
Cheers,
Steven

[Steven Nagy]

Hi Shawn,

So when you say "setup a machine key for each virtual directory".. that
sounds like an IIS thing to me.

As per my original statement:

>Configuring web servers and so on is not much of an option here. I need

an in code solution.

If what you are talking about is not IIS related then please explain
further what you mean. I did a google for "machine key" and "setup a
machine key for each virtual directory" and also "machine key virtual
directory" and all results related to IIS configuration. Perhaps I am
missing something here?

Many thanks,
Steven