?
Solved

500 points - IIS - ASP.Net - Forms authentication - AUTH_USER

Posted on 2007-04-09
8
Medium Priority
?
1,595 Views
Last Modified: 2013-12-25
Hi,
In my web application I am using Forms authentication. When the user successfully authenticated, will the AUTH_USER http header variable will be set to the authenticated user id?
Can I relay on the REMOTE_USER or AUTH_USER to retrieve the user information?
How I can control these varibles from IIS and ASP.NET forms authentication?
Thanks,
Shaji.
0
Comment
Question by:shajijohn2121
  • 4
  • 4
8 Comments
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18877122
AUTH_USER is for Windows authentication, and is the authenticated user.

With Forms authentication, the credentials are available from form fields, rather than server variables.

Which version of the .NET framework are you using?  2.0 or 1.1?

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18877609
Hi Bob,
Thanks for your replay. Let me explain the situation in detaisl.
I am in the process of designing SSO for few internet portal applications. These portals are meant for our cutomers. Currently each of these portals have their user database (relational - SQL server). They authenticate user agains these database. My project is to implement SSO for these portals. Note that one of these web application is on Apache/Solaris and java and all others are on IIS 6.0/Windows 2003 and .Net 2.0.
My prposed design is to:
1. Create a common data store - active directory to store the user details including credential. All application will use this as the data store for authentication. User registration will insert entry into the directory.
2. WebSSO using identity token and authentication cookies. The portal which is requested first will prompt for user credentials and on successful validation will create the token and write to browser cookies.
3. All these portals are in same parent domain but in different sub domain, like www.portal1.mycompany.com. So I think the cookie approach will work.
4. But the issue is the Java web application on Apache/Solaris. This is product we bought from a vendor. They say their system supports web SSO through REMOTE_USER (or any other as they can configure their server to pick user id from any environment variable like AUTH_USER)environment variable. What I need to do is to set this variable from my server to the authenticated user id. They will read the user id and will not prompt for user credential again. (Frankly I dont know much about this approach).

I have few questions here:
1. Is my design approach robust and secure?
2. Will it work for all browsers and platform (if cookies are enabled).
3. If the approach listed in '4' above, reliable and secure?
4. Can I implement '4'  from my .net/IIS portals? If yes, what I need to do here?
5. Can I use approach '4' to implement SSO across all portals, ditching cookie approach?

Please help me with these questions? I dont know much about CGI, environment variables etc.

Thanks,
Shaji.
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18891419
Shaji,

Have you seen articles like this fairly detailed MSDN article?

Single Sign-On Enterprise Security for Web Applications
http://msdn2.microsoft.com/en-us/library/ms972971.aspx

Bob
0
Restore individual SQL databases with ease

Veeam Explorer for Microsoft SQL Server delivers an easy-to-use, wizard-driven interface for restoring your databases from a backup. No expert SQL background required. Web interface provides a complete view of all available SQL databases to simplify the recovery of lost database

 

Author Comment

by:shajijohn2121
ID: 18895202
Hi Bob,

Thanks for the link. I have seen that. My design pretty much takes care the SSO across web applications on IIS/Windows. I am stuck with this app on Apache/Solaris. And setting the env variable for them.
Please let me know if you have solution which will address this application too.

Thanks,
Shaji.
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18897077
Shaji,

That's a shame, since I don't have experience with Apache/Solaris.  Did you ask the vendor how their SSO solution with REMOTE_USER would work in your situation?

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18897544
No problem Bob.
I checked with Vendor, they say I can have a filter in Apache to translate the cookie to env variable. I need to verify that.
Thanks for your inputs. Do you see any issue with my design in general?

Thanks,
Shaji
0
 
LVL 96

Accepted Solution

by:
Bob Learned earned 1000 total points
ID: 18900664
I would have to admit that SSO is not my area of expertise, so it is difficult to say that your design is good or bad.

Bob
0
 

Author Comment

by:shajijohn2121
ID: 18901547
Ok. Thanks Bob.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Active Directory replication delay is the cause to many problems.  Here is a super easy script to force Active Directory replication to all sites with by using an elevated PowerShell command prompt, and a tool to verify your changes.
In threads here at EE, each comment has a unique Identifier (ID). It is easy to get the full path for an ID via the right-click context menu. However, we often want to post a short link within a thread rather than the full link. This article shows a…
Learn the basics of while and for loops in Python.  while loops are used for testing while, or until, a condition is met: The structure of a while loop is as follows:     while <condition>:         do something         repeate: The break statement m…
In this fourth video of the Xpdf series, we discuss and demonstrate the PDFinfo utility, which retrieves the contents of a PDF's Info Dictionary, as well as some other information, including the page count. We show how to isolate the page count in a…
Suggested Courses
Course of the Month15 days, 11 hours left to enroll

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question