ASP.net authentication failes when accessing the page over an http redirect

Staudte
Staudte used Ask the Experts™
on
Hi Experts,

a really wierd problem has suddenly popped up yesterday. In short, authentication to an ASP.net application hosted on my Windows 2003 server suddenly failed. There was no error message, i.e. the loginview control apparently confirmed that user's credentials properly, but the user was not authenticated and the application always returned to the welcome screen instead of processing further. When I logged in from within the local network, it worked fine.

I have meanwhile found the cause of the problem, and now need some advice on how to fix it, but I need to explain some background first: lets assume the asp.net server is named www.complexname.com. Users, however, are supposed to use www.friendlyname.com. I have set up a hidden http redirection in my DNS-provider's system (domaindiscount24.com) which redirects www.friendlyname.com -> www.complexname.com.

The problem occurs if users log in using www.friendlyname.com. It works fine if they use www.complexname.com (which they are not supposed to). It also works if I change the redirection type to "simple (301)", but then the users see that they are redirected, as the real address www.complexname.com appears in the URL-line of their browser (which is not desired). BTW, the provider implements the "hidden" redirection by using frames. Here's the code of that redicrection page:

<html><head><title>www.friendlyname.com</title></head><frameset BORDER='0' frameborder='0' framespacing='0' rows='100%,*'>
<frame name='target' src='http://www.complexname.com'>
<noframes>  <body BGCOLOR='#FFFFFF'>
This page requires that your browser supports frames.
<BR>You can access the page without frames with this <a href='http://www.complexname.com'>link</A>.
</body></noframes></frameset></html>

What is odd is that this has worked for a long time now, and suddenly yesterday it didn't work anymore.

Is there a way I can get ASP.net authentication to work even if the application appears in the frame of some other server's web page?

Thanks a lot for any hints and suggestions.

Thomas
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Muhammad Ousama GhazaliSolution Analyst & Architect

Commented:
Instead of redirection if you could have a "site alias" feature with your web application hosting company/DNS Provider, it might solve your problem because as per my knowledge, "site alias" is just pointing to the same ASP.NET application or any web site but with a different domain name.
Further, it is strange for me to see frame implementation as part of redirection, which actually does not seem redirection but display of another site from within the same page using frames and recently browsers such as IE7/IE8 have implemented new security features which does not allow communication from frames to the host page so it might be one of the reason your application has stopped working recently but had been working previously.

Author

Commented:
I'm not sure that I understand where I would define the site alias. I'll give you some details:

The DNS provider for both domains is domaindiscount24.com. They also provide mail services for friendlyname.com. The ASP.net application, however, lives on a server with me and is connected to the Internet using a dynamic IP address. Unfortunately, domaindiscount24.com does not provide means to update the A-record of a host dynamically. So I got a dyndns domain (complexname.com), which I'm updating from the server with the ASP.net application. Users, however, shouldn't need to bother or see complexname.com, so I need an invisible way to redirect them there whenever they surf to www.friendlyname.com. I can't transfer the domain or nameservers from domaindiscount24 to dyndns, because of the mailservices, which have to stay at domaindiscount24.

What puuzles me is that the frame-redirection has worked fine in the past and suddenly stopped. I've asked domaindiscount24 support if they have changed anything, but I need to wait til monday for a response.

With that in mind, do you still think a "site alias" would help me? If so, could you, please, give me some more details on where I should define this?

Thanks again for your support!
Muhammad Ousama GhazaliSolution Analyst & Architect

Commented:
Now I understand you situation very much and beleive me it is a tough situation for me to come up with an excellent and out of the box solution.
However, my understanding is that even though you have email services with domaindiscount24.com which you don't wish to disturb but at the same time want to have a direct pointing to your site on the server that lies with you at home/company using DynDns.org services which allows dynamic IP assigned to you by ISP to be propagated as the IP Address of your something.dyndns.org URL. My simple answer might be to use the DynDNS Custom DNS service (http://www.dyndns.com/services/dns/custom/) which costs $27.50 per year (http://www.dyndns.com/services/pricing/#dns) and point MX records of domaindiscount24.com within CP of DynDNS to keep your email boxes still being alive.
Our routine is to keep domain name registration with primary registrar (such as name.com) and setup DNS there by ourselves using their CP and point Email Servers of Google utilizing Google Apps for free which provide Gmail-backed 50 mailboxes and also point A-records or name servers to the site/hosting server (which in your case is DynDNS).
How to Generate Services Revenue the Easiest Way

This Tuesday! Learn key insights about modern cyber protection services & gain practical strategies to skyrocket business:

- What it takes to build a cloud service portfolio
- How to determine which services will help your unique business grow
- Various use-cases and examples

Author

Commented:
Well, this is exactly what I tried - actually complexname.com is a Dyndns custom name service. The problem is with domaindiscount24 - as soon as you move the nameservers away from them to Dyndns you loose their mailservice; I would say a fault/misplanning at their system.

Well, the core question "why did it until now" can apparently not be answered until I know if domaindiscount24 have changed their "hidden redirection" mechanism...

Author

Commented:
Ok, I've got reply from the supporter who is responsibe for the web-site redirection: They haven't changed anything recently. Noone has changed anything... yet still it broke suddenly. I hate when this happens :-}

The new security mechanisms of IE8 etc aren't causing this either; I've just gotten my hands on an ancient IE6 installation, and this fails to authenticate when redirected, too.

On the assumption that there will be no further progress on the issue, I'll relocate the server within a couple of weeks to another machine/ISP with multiple static public IP addresses, which will take care of the problem.

Thanks for looking into this.

Thomas
Solution Analyst & Architect
Commented:
I tried looking into a feasible answer but could not come up with one that would really work for you except what I already have suggested.
I currently use reliablesite.net for my hostings because they are comparatively cheap and provide good feature-set with moderately good services/uptime, so you may check with them. The site alias feature I earlier mentioned was also known to me through DotNetPanel they have for their hosting.
I hope it all turns good for you.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial