Cross-site verification

Http://www.cnblogs.com/windsails/archive/2004/10/15/52818.aspx

A recent friend asked me a question:

How can I put aspdotnet forum2.0 in one of his projects (as if someone has discussed on the internet how to integrate dottext and aspdotnet forum among other open-source projects ), his original project already has a set of user login mechanisms, and the user database is also ready-made. How can he directly go to Forum after logging on to his original system, but does not need to input user information again? At first, I felt like a piece of cake... like this one-time login, and then access to multiple applications has actually been proposed for a long time. Several years ago, I helped the company develop a similar product prototype, but it is for heterogeneous websites, to put it bluntly, it is just a proxy, but there is an internal mechanism to map the user databases of several heterogeneous websites. This method seems to be able to solve the problem, but it is very troublesome to process the ing between databases. If there are more applications below, the workload will be huge.

This technology seems to be called single sign on, a bit like Netease's pass. If the internal website is the same group of people, the problem is not big, as long as the format of the pass and some related issues are properly coordinated. The situation of a friend does not seem to be so complicated. His original project also uses the. NET platform technology .. Is there a better integration solution under the. NET platform?

This naturally involves issues related to verification on the. NET platform. ASP. NET itself supports three authentication methods (excluding none ):

1. For Windows authentication, it seems that this method is used by default to create a new Web application. Obviously this is not required.

2. passprot authentication requires Microsoft support. In fact, it provides a WebServices to help you complete the verification work in a unified manner. It does not seem necessary to use this in an internal network project.

3. Forms authentication: pass authentication information through cookies. It looks like a pass, and it should be something to find.

Figure shows the data flowchart of Forms authentication (in msdn)

The basic principles of Forms authentication are clearly described, but what about multiple applications? Check msdn carefully (msdn has a lot of information. I often read it and try again. I forgot to find it there. BTW: Is there any msdn bookmarks ?), There are many descriptions, but only one "cross-application forms authentication" is more specific, and the content is simpler.

It seems that you still need to manually perform a simple test to try and check the information...

Create a testlogon web application first

Main files include:

Default. aspx (the page jumps through verification)

Test1.apsx (logon page)

Global. asax

Web. config (configuration file)

Create another testlogon2 Web Application

Main files:

Default. aspx (the page jumps through verification)

Global. asax

Web. config (configuration file)

The final result of the test:

The default values of the two web applications are protected and cannot be accessed without verification. Even if the access Address URL is entered, the system automatically jumps to testlogon \ test1.aspx to log on. After the logon is successful, the default value can be any one of the two applications. aspx jump.

Testlogon \ default. aspx has the logout function. After logging out, You need to log on again.

To achieve this, the basic settings need:

1. Configure IIS to allow anonymous access to ensure that requests can be transferred to ASP. NET through IIS control;

2. If you need to configure the transmission process as SSL, this is not necessary here;

3. The configuration files of the two applications must be consistent;

The above basic settings can be found in the relevant description in msdn, but it takes a longer time for the experiment to succeed, so it is necessary to record it, it is good for you and others.

The lessons learned are as follows:

1. In the configuration file web. config, set the Authentication Mode to forms. In the following parameters, ensure that both sides are consistent.

Corresponding part of testlogon web. config

<Authentication mode = "forms">

<Forms name = ". aspnetforums" Protection = "encryption" timeout = "60" loginurl = "test1.aspx"/>

</Authentication>

Corresponding part of Web. config of testlogon2

<Authentication mode = "forms">

<Forms name = ". aspnetforums" Protection = "encryption" timeout = "60" loginurl = "\ testlogon \ test1.aspx"/>

</Authentication>

2. The addition of <machinekey> is required.

This attribute is required and must be the same to ensure that the applications on both sides process and read cookies.

<Machinekey

Validationkey = "Courier"

Decryptionkey = "8a9be8fd67af6979e7d20198cfea50dd3d3799c77af2b72f"

Validation = "sha1">

</Machinekey>

3. Although msdn needs to be checked, it cannot be fully relied on, especially the code.

In msdn, The machinekey code is as follows:

<Configuration>

<System. Web>

<Authentication>

<Forms name = ". aspxauth"

Loginurl = "Logon. aspx"

Protection = "all" <! -- Protection must be identical. -->

Timeout = "30"

Path = "/"> <! -- Path must have a compatible scope. -->

</Authentication>


<! -- Validation and decryption keys must exactly match and cannot

Be set to "autogenerate". The validation algorithm must also

Be the same. -->

<Machinekey>

Validationkey = "Courier"

Decryptionkey = "8a9be8fd67af6979e7d20198cfea50dd3d3799c77af2b72f"

Validation = "sha1"

Isolateapplications = "false"

</Machinekey>

</System. Web>

</Configuration>

 

But obviously there is something wrong. You will understand it after compilation. The format is wrong, and isolateapplication is not used in this way.

4. To ensure that the cookies read on both sides are consistent, do not use isolateapplication so that they use their own cookies.

5. Note that the authentication node in Web. config will trigger events in global. asax, corresponding

Function is

Protected void application_authenticaterequest (Object sender, eventargs E)

6. After studying the aspdotnetforum2.0 code, we found that global. asax is missing, but another one is added to its configuration file.

<Httpmodules>

<Add name = "aspnetforums" type = "aspnetforums. forumshttpmodule, aspnetforums. Components"/>

</Httpmodules>

Yes. Let's take a look at the source code of forumshttpmodule. The structure is basically the same as that of global. asax. There is also an event-triggered function.

Private void application_authenticaterequest (Object source, eventargs E)

I don't need to talk about it anymore? The answer to how to achieve SSO with dotnetforum has come out.

Sample Code download