Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

500 points - IIS - ASP.Net - Forms authentication - AUTH_USER

Posted on 2007-04-09
8
Medium Priority
?
1,581 Views
Last Modified: 2013-12-25
Hi,
In my web application I am using Forms authentication. When the user successfully authenticated, will the AUTH_USER http header variable will be set to the authenticated user id?
Can I relay on the REMOTE_USER or AUTH_USER to retrieve the user information?
How I can control these varibles from IIS and ASP.NET forms authentication?
Thanks,
Shaji.
0
Comment
Question by:shajijohn2121
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18877122
AUTH_USER is for Windows authentication, and is the authenticated user.

With Forms authentication, the credentials are available from form fields, rather than server variables.

Which version of the .NET framework are you using?  2.0 or 1.1?

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18877609
Hi Bob,
Thanks for your replay. Let me explain the situation in detaisl.
I am in the process of designing SSO for few internet portal applications. These portals are meant for our cutomers. Currently each of these portals have their user database (relational - SQL server). They authenticate user agains these database. My project is to implement SSO for these portals. Note that one of these web application is on Apache/Solaris and java and all others are on IIS 6.0/Windows 2003 and .Net 2.0.
My prposed design is to:
1. Create a common data store - active directory to store the user details including credential. All application will use this as the data store for authentication. User registration will insert entry into the directory.
2. WebSSO using identity token and authentication cookies. The portal which is requested first will prompt for user credentials and on successful validation will create the token and write to browser cookies.
3. All these portals are in same parent domain but in different sub domain, like www.portal1.mycompany.com. So I think the cookie approach will work.
4. But the issue is the Java web application on Apache/Solaris. This is product we bought from a vendor. They say their system supports web SSO through REMOTE_USER (or any other as they can configure their server to pick user id from any environment variable like AUTH_USER)environment variable. What I need to do is to set this variable from my server to the authenticated user id. They will read the user id and will not prompt for user credential again. (Frankly I dont know much about this approach).

I have few questions here:
1. Is my design approach robust and secure?
2. Will it work for all browsers and platform (if cookies are enabled).
3. If the approach listed in '4' above, reliable and secure?
4. Can I implement '4'  from my .net/IIS portals? If yes, what I need to do here?
5. Can I use approach '4' to implement SSO across all portals, ditching cookie approach?

Please help me with these questions? I dont know much about CGI, environment variables etc.

Thanks,
Shaji.
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18891419
Shaji,

Have you seen articles like this fairly detailed MSDN article?

Single Sign-On Enterprise Security for Web Applications
http://msdn2.microsoft.com/en-us/library/ms972971.aspx

Bob
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Author Comment

by:shajijohn2121
ID: 18895202
Hi Bob,

Thanks for the link. I have seen that. My design pretty much takes care the SSO across web applications on IIS/Windows. I am stuck with this app on Apache/Solaris. And setting the env variable for them.
Please let me know if you have solution which will address this application too.

Thanks,
Shaji.
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18897077
Shaji,

That's a shame, since I don't have experience with Apache/Solaris.  Did you ask the vendor how their SSO solution with REMOTE_USER would work in your situation?

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18897544
No problem Bob.
I checked with Vendor, they say I can have a filter in Apache to translate the cookie to env variable. I need to verify that.
Thanks for your inputs. Do you see any issue with my design in general?

Thanks,
Shaji
0
 
LVL 96

Accepted Solution

by:
Bob Learned earned 1000 total points
ID: 18900664
I would have to admit that SSO is not my area of expertise, so it is difficult to say that your design is good or bad.

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18901547
Ok. Thanks Bob.
0

Featured Post

Enroll in October's Free Course of the Month

Do you work with and analyze data? Enroll in October's Course of the Month for 7+ hours of SQL training, allowing you to quickly and efficiently store or retrieve data. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Lync server 2013 or Skype for business Backup Service Error ID 4049 – After File Share Migration
It was really hard time for me to get the understanding of Delegates in C#. I went through many websites and articles but I found them very clumsy. After going through those sites, I noted down the points in a easy way so here I am sharing that unde…
Learn the basics of if, else, and elif statements in Python 2.7. Use "if" statements to test a specified condition.: The structure of an if statement is as follows: (CODE) Use "else" statements to allow the execution of an alternative, if the …
Video by: Mark
This lesson goes over how to construct ordered and unordered lists and how to create hyperlinks.
Suggested Courses

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question