Solved

500 points - IIS - ASP.Net - Forms authentication - AUTH_USER

Posted on 2007-04-09
8
1,574 Views
Last Modified: 2013-12-25
Hi,
In my web application I am using Forms authentication. When the user successfully authenticated, will the AUTH_USER http header variable will be set to the authenticated user id?
Can I relay on the REMOTE_USER or AUTH_USER to retrieve the user information?
How I can control these varibles from IIS and ASP.NET forms authentication?
Thanks,
Shaji.
0
Comment
Question by:shajijohn2121
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18877122
AUTH_USER is for Windows authentication, and is the authenticated user.

With Forms authentication, the credentials are available from form fields, rather than server variables.

Which version of the .NET framework are you using?  2.0 or 1.1?

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18877609
Hi Bob,
Thanks for your replay. Let me explain the situation in detaisl.
I am in the process of designing SSO for few internet portal applications. These portals are meant for our cutomers. Currently each of these portals have their user database (relational - SQL server). They authenticate user agains these database. My project is to implement SSO for these portals. Note that one of these web application is on Apache/Solaris and java and all others are on IIS 6.0/Windows 2003 and .Net 2.0.
My prposed design is to:
1. Create a common data store - active directory to store the user details including credential. All application will use this as the data store for authentication. User registration will insert entry into the directory.
2. WebSSO using identity token and authentication cookies. The portal which is requested first will prompt for user credentials and on successful validation will create the token and write to browser cookies.
3. All these portals are in same parent domain but in different sub domain, like www.portal1.mycompany.com. So I think the cookie approach will work.
4. But the issue is the Java web application on Apache/Solaris. This is product we bought from a vendor. They say their system supports web SSO through REMOTE_USER (or any other as they can configure their server to pick user id from any environment variable like AUTH_USER)environment variable. What I need to do is to set this variable from my server to the authenticated user id. They will read the user id and will not prompt for user credential again. (Frankly I dont know much about this approach).

I have few questions here:
1. Is my design approach robust and secure?
2. Will it work for all browsers and platform (if cookies are enabled).
3. If the approach listed in '4' above, reliable and secure?
4. Can I implement '4'  from my .net/IIS portals? If yes, what I need to do here?
5. Can I use approach '4' to implement SSO across all portals, ditching cookie approach?

Please help me with these questions? I dont know much about CGI, environment variables etc.

Thanks,
Shaji.
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18891419
Shaji,

Have you seen articles like this fairly detailed MSDN article?

Single Sign-On Enterprise Security for Web Applications
http://msdn2.microsoft.com/en-us/library/ms972971.aspx

Bob
0
Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

 

Author Comment

by:shajijohn2121
ID: 18895202
Hi Bob,

Thanks for the link. I have seen that. My design pretty much takes care the SSO across web applications on IIS/Windows. I am stuck with this app on Apache/Solaris. And setting the env variable for them.
Please let me know if you have solution which will address this application too.

Thanks,
Shaji.
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18897077
Shaji,

That's a shame, since I don't have experience with Apache/Solaris.  Did you ask the vendor how their SSO solution with REMOTE_USER would work in your situation?

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18897544
No problem Bob.
I checked with Vendor, they say I can have a filter in Apache to translate the cookie to env variable. I need to verify that.
Thanks for your inputs. Do you see any issue with my design in general?

Thanks,
Shaji
0
 
LVL 96

Accepted Solution

by:
Bob Learned earned 500 total points
ID: 18900664
I would have to admit that SSO is not my area of expertise, so it is difficult to say that your design is good or bad.

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18901547
Ok. Thanks Bob.
0

Featured Post

Three Reasons Why Backup is Strategic

Backup is strategic to your business because your data is strategic to your business. Without backup, your business will fail. This white paper explains why it is vital for you to design and immediately execute a backup strategy to protect 100 percent of your data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

International Data Corporation (IDC) prognosticates that before the current the year gets over disbursing on IT framework products to be sent in cloud environs will be $37.1B.
A quick Powershell script I wrote to find old program installations and check versions of a specific file across the network.
Learn the basics of while and for loops in Python.  while loops are used for testing while, or until, a condition is met: The structure of a while loop is as follows:     while <condition>:         do something         repeate: The break statement m…
The viewer will learn the basics of jQuery, including how to invoke it on a web page. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery.: (CODE)

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question