?
Solved

500 points - IIS - ASP.Net - Forms authentication - AUTH_USER

Posted on 2007-04-09
8
Medium Priority
?
1,576 Views
Last Modified: 2013-12-25
Hi,
In my web application I am using Forms authentication. When the user successfully authenticated, will the AUTH_USER http header variable will be set to the authenticated user id?
Can I relay on the REMOTE_USER or AUTH_USER to retrieve the user information?
How I can control these varibles from IIS and ASP.NET forms authentication?
Thanks,
Shaji.
0
Comment
Question by:shajijohn2121
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18877122
AUTH_USER is for Windows authentication, and is the authenticated user.

With Forms authentication, the credentials are available from form fields, rather than server variables.

Which version of the .NET framework are you using?  2.0 or 1.1?

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18877609
Hi Bob,
Thanks for your replay. Let me explain the situation in detaisl.
I am in the process of designing SSO for few internet portal applications. These portals are meant for our cutomers. Currently each of these portals have their user database (relational - SQL server). They authenticate user agains these database. My project is to implement SSO for these portals. Note that one of these web application is on Apache/Solaris and java and all others are on IIS 6.0/Windows 2003 and .Net 2.0.
My prposed design is to:
1. Create a common data store - active directory to store the user details including credential. All application will use this as the data store for authentication. User registration will insert entry into the directory.
2. WebSSO using identity token and authentication cookies. The portal which is requested first will prompt for user credentials and on successful validation will create the token and write to browser cookies.
3. All these portals are in same parent domain but in different sub domain, like www.portal1.mycompany.com. So I think the cookie approach will work.
4. But the issue is the Java web application on Apache/Solaris. This is product we bought from a vendor. They say their system supports web SSO through REMOTE_USER (or any other as they can configure their server to pick user id from any environment variable like AUTH_USER)environment variable. What I need to do is to set this variable from my server to the authenticated user id. They will read the user id and will not prompt for user credential again. (Frankly I dont know much about this approach).

I have few questions here:
1. Is my design approach robust and secure?
2. Will it work for all browsers and platform (if cookies are enabled).
3. If the approach listed in '4' above, reliable and secure?
4. Can I implement '4'  from my .net/IIS portals? If yes, what I need to do here?
5. Can I use approach '4' to implement SSO across all portals, ditching cookie approach?

Please help me with these questions? I dont know much about CGI, environment variables etc.

Thanks,
Shaji.
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18891419
Shaji,

Have you seen articles like this fairly detailed MSDN article?

Single Sign-On Enterprise Security for Web Applications
http://msdn2.microsoft.com/en-us/library/ms972971.aspx

Bob
0
The Eight Noble Truths of Backup and Recovery

How can IT departments tackle the challenges of a Big Data world? This white paper provides a roadmap to success and helps companies ensure that all their data is safe and secure, no matter if it resides on-premise with physical or virtual machines or in the cloud.

 

Author Comment

by:shajijohn2121
ID: 18895202
Hi Bob,

Thanks for the link. I have seen that. My design pretty much takes care the SSO across web applications on IIS/Windows. I am stuck with this app on Apache/Solaris. And setting the env variable for them.
Please let me know if you have solution which will address this application too.

Thanks,
Shaji.
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18897077
Shaji,

That's a shame, since I don't have experience with Apache/Solaris.  Did you ask the vendor how their SSO solution with REMOTE_USER would work in your situation?

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18897544
No problem Bob.
I checked with Vendor, they say I can have a filter in Apache to translate the cookie to env variable. I need to verify that.
Thanks for your inputs. Do you see any issue with my design in general?

Thanks,
Shaji
0
 
LVL 96

Accepted Solution

by:
Bob Learned earned 1000 total points
ID: 18900664
I would have to admit that SSO is not my area of expertise, so it is difficult to say that your design is good or bad.

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18901547
Ok. Thanks Bob.
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When it comes to showing a 404 error page to your visitors, you do not want that generic page to show, and you especially do not want your hosting provider’s ad error page to show either. In this article, I will show you how to enable the custom 40…
Preparing an email is something we should all take special care with – especially when the email is for somebody you may not know very well. The pressures of everyday working life stacked with a hectic office environment can make this a real challen…
The viewer will learn how to count occurrences of each item in an array.
The viewer will learn how to create and use a small PHP class to apply a watermark to an image. This video shows the viewer the setup for the PHP watermark as well as important coding language. Continue to Part 2 to learn the core code used in creat…
Suggested Courses

801 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question