500 points - IIS - ASP.Net - Forms authentication - AUTH_USER

AUTH_USER is for Windows authentication, and is the authenticated user.

With Forms authentication, the credentials are available from form fields, rather than server variables.

Which version of the .NET framework are you using?  2.0 or 1.1?

Bob

Hi Bob,
Thanks for your replay. Let me explain the situation in detaisl.
I am in the process of designing SSO for few internet portal applications. These portals are meant for our cutomers. Currently each of these portals have their user database (relational - SQL server). They authenticate user agains these database. My project is to implement SSO for these portals. Note that one of these web application is on Apache/Solaris and java and all others are on IIS 6.0/Windows 2003 and .Net 2.0.
My prposed design is to:
1. Create a common data store - active directory to store the user details including credential. All application will use this as the data store for authentication. User registration will insert entry into the directory.
2. WebSSO using identity token and authentication cookies. The portal which is requested first will prompt for user credentials and on successful validation will create the token and write to browser cookies.
3. All these portals are in same parent domain but in different sub domain, like www.portal1.mycompany.com. So I think the cookie approach will work.
4. But the issue is the Java web application on Apache/Solaris. This is product we bought from a vendor. They say their system supports web SSO through REMOTE_USER (or any other as they can configure their server to pick user id from any environment variable like AUTH_USER)environment variable. What I need to do is to set this variable from my server to the authenticated user id. They will read the user id and will not prompt for user credential again. (Frankly I dont know much about this approach).

I have few questions here:
1. Is my design approach robust and secure?
2. Will it work for all browsers and platform (if cookies are enabled).
3. If the approach listed in '4' above, reliable and secure?
4. Can I implement '4'  from my .net/IIS portals? If yes, what I need to do here?
5. Can I use approach '4' to implement SSO across all portals, ditching cookie approach?

Please help me with these questions? I dont know much about CGI, environment variables etc.

Thanks,
Shaji.

Shaji,

Have you seen articles like this fairly detailed MSDN article?

Single Sign-On Enterprise Security for Web Applications
http://msdn2.microsoft.com/en-us/library/ms972971.aspx

Bob

Hi Bob,

Thanks for the link. I have seen that. My design pretty much takes care the SSO across web applications on IIS/Windows. I am stuck with this app on Apache/Solaris. And setting the env variable for them.
Please let me know if you have solution which will address this application too.

Thanks,
Shaji.

Shaji,

That's a shame, since I don't have experience with Apache/Solaris.  Did you ask the vendor how their SSO solution with REMOTE_USER would work in your situation?

Bob

No problem Bob.
I checked with Vendor, they say I can have a filter in Apache to translate the cookie to env variable. I need to verify that.
Thanks for your inputs. Do you see any issue with my design in general?

Thanks,
Shaji

Ok. Thanks Bob.