FormsAuthentication to PHP

[Kim André Akerø]

I'm trying to make my PHP scripts communicate with a ASP.NET based
authentication solution.

I have $_COOKIE["FormsAuth"], but it's encrypted using the
FormsAuthentication.Encrypt method.

This is the example code showing the encryption:
http://dev.bd0.net/test/formsauth.txt

Is there a way to decrypt this cookie using PHP?

Here's an overview of FormsAuthentication methods in ASP.NET for those
who are curious:
<http://msdn2.microsoft.com/en-us/lib...ity.formsauthe
ntication_methods.aspx>

--
Kim André Akerø
- ki******@NOSPAMbetadome.com
(remove NOSPAM to contact me directly)

[Jerry Stuckle]

Kim André Akerø wrote:

I'm trying to make my PHP scripts communicate with a ASP.NET based
authentication solution.

I have $_COOKIE["FormsAuth"], but it's encrypted using the
FormsAuthentication.Encrypt method.

This is the example code showing the encryption:
http://dev.bd0.net/test/formsauth.txt

Is there a way to decrypt this cookie using PHP?

Here's an overview of FormsAuthentication methods in ASP.NET for those
who are curious:
<http://msdn2.microsoft.com/en-us/lib...ity.formsauthe
ntication_methods.aspx>

Hi, Kim,

If you knew the algorithm they used for doing the encryption you could.
But without that you don't stand much chance. And unfortunately, I
don't seen any of the gory details on that page.

I did a quick google search to see if I could come up with anything
about how they do it, but didn't find anything. I guess someone would
have to reverse engineer the code - which would be difficult, but not
impossible.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[NC]

Kim André Akerø wrote:

>
I'm trying to make my PHP scripts communicate with
a ASP.NET based authentication solution.

I have $_COOKIE["FormsAuth"], but it's encrypted using
the FormsAuthentication.Encrypt method.

FormsAuthentication.Encrypt produces a serialized
FormsAuthenticationTicket object...

Is there a way to decrypt this cookie using PHP?

Yes, but only on Windows. You'll have to define a COM or a DOTNET
object and decrypt the cookie the Windows way, using
FormsAuthentication.Decrypt...

A much simpler solution would be to tweak with the ASP.Net code and
have it explicitly set cookies based on FormsAuthenticationTicket
properties (CookiePath, Expiration, Expired, IsPersistent, IssueDate,
Name, UserData, Version). Something along these lines:

Dim cookie As HttpCookie
cookie = New HttpCookie("Expiration")
cookie.Value = authTicket.Expiration.ToString
Response.Cookies.Add(cookie)

Then, instead of dealing with the serialized object in
$_COOKIE["FormsAuth"], you would be dealing with plain and simple
$_COOKIE['Expiration'].

My guess is that about the only value you really need is Expiration...

Cheers,
NC