Security :: Forms Authentication Not Working On Some Systems?
Jan 28, 2010
Recently I've implemnted Single SignOn feature in my website which was developed on Framwork 2.0 using visual studio 2005.These website works on all browsers perfectly except that there two systems in my testing environment where the FormsAuthentication doesn't work on IE only.
On Those systems itself FormsAuthentication works for other browsers like mozilla.On these system I have checked that FormsAuthentication cookie is created but it lost it value as soon as other page is traversed.But when I try to login again it give me the messsage that user is already login i.e. user was able to login successfully.Both of them are currenlty using IE 8.
Here I am using forms authentication and I have used an access database. I have put the db in App_Data folder and declared the connectionstring in web.config. The problem I am facing is that when I request any page without logging in the browser displays the requested page. At the bottom of the page there is a script error when I check the details it says Sys is not defined. Has this something to do with this issue??
In web.config file I have added the following lines in the <system.web></system.web> section.
On login button click after comparing userid & password I am using the foll stmts:-
If code = 0 Then ' code 0 means match for userid and pwd FormsAuthentication.RedirectFromLoginPage(txtuserid.Text, False) Else Response.Redirect("~/Default.aspx") End If
I have a .net 1.1 ASP application (domain.com) which has a .net 2 virtual directory (domain.com/v2) beneath it, both applications run within their own app pool on the same Windows Server 2003 machine running IIS 6. The web.config files for both apps are setup for Forms Authentication as described here - [URL]
Users would be directed to the domain.com/v2/login.aspx page which would authenticate for both applications, this configuration has been working fine for the last few years until installing one of the recent Windows 2003 security updates today. Now after authenticating under /v2 users keep getting redirected back to domain.com/v2/Login.aspx as domain.com doesnt see them as authenticated anymore.
which security update would have caused this and if its possible to fix or rollback?
I have implemented the .Net Membership provider with my website which is, for the most part, working well. However, occasionally a user will try and login and nothing will happen. There will be no error, they will just hit "Submit" from the login screen and continue to the homepage as an unauthenticated user. This behavior persists until they clear their web cache, or restart their machine... which makes me think it's some kind of cookie expiration error?
Does anyone have any ideas on how to troubleshoot this?
My system is an asp.net website which uses sql server 2008 (mostly stored procedures, but for asychnronous calls I directly insert the sql commands). I have a web service which polls multiple databases, I use external libraries(Including office interop), and allow for uploading and downloading files - without restriction.
My asp pages use javascript and jquery for most of their functionality.
I've found this article on enabling windows authentication within an intranet ASP.NET application. I did exactly what the article says, and when I go to the page on the server all it does is prompt me for a username and password, which I would assume means that it is seeing me as an anonymous user and not a windows user (which is not true).
In my application on the IIS i have the "Integrated Windows Authentication" box checked and this is what I have for my web.config file:
[Code]....
I've also tried this before and got the same results:
[Code]....
I have no idea what I need to do to get this to authenticate correctly. I've been banging my head off a wall for the past 2 days on this issue.
I have a basic intranet website for my company but there is one page that cannot allow anonymous as I need to grab the user's login. I created the site and everything works perfectly on my development machine. once moved to the production server it no longer works.
Here is the problem: I can get the login prompt when going to the secure page, but when trying to login I get a "401.1 - Unauthorized", even when trying to login as a server administrator. Here is the authentication portion in my web.config:
[Code]....
I have done this before and always gotten it to work. I hope I am just missing something very simple...
I'm trying to write a simple ASP.NET 4.0 app, using Windows authentication to login. This is on my peer-to-peer home network. When I click to login, it instantly shows my Windows identity, so it looks as though I don't even need to login, as it's already done that for me. However when I then go to any other page in the app, it looks as though I'm not logged in. Why is that and how do I fix it?
I have created a we app. using win authentication. When type the server ip addres in chrome I get the login window and it works just fine with my organizations credentials, however when doing the same using Internet Explorer I have to login with the server credentials as my account is not valid.
I know this is working correctly beacuse when I publish my website to my hosting provider, and request a resource in a protected directory, and I am not currently authenticated, I get automatically redirected to my login page and then once successfully authenticated granted access and redirected back to the sure *.aspx file in my protected directory (assuming I am authorized for those resources).
So that is working no problem.
However, when I run this from visual studio 2008 (F5) in debug mode, I am not being required to authenticate. It simply serves up the protected resource without asking for my credentials.
If I put a [PrincipalPermission(SecurityAction.Demand, Authenticated = true)] on a BLL class method, it will throw an security exception, but the page that is calling it is in a secure directory and I am never asked to authenticate using the login page.
I am closing and re-opening brosers, clearing cookies, etc..., but no matter what I do I am not automatically redirected to the login page, and the secure page when I launch from visual Studio running on the embedded local host. Thiis working perfectly externally, same build, same web.config, pointing to the same database, on the hosting provider. (yes, eventually, I will be using dev/test/prod db configurations to test, but for now for simplicity I am keeping it the same)
Not only is it maddening, but worse yet, it would obviously make testing this application impossible after the initial release.
I have developed the authenticated rss feed using the basic http authentication for my site.I also have the admin module for the site which uses the Asp.net Forms Authentication .Both are in the same project.When i turn on the forms authentication module to None in my web.config.My rss feed authentication works fine(the browser pop up the dialog box for the username and password) and upon entering the username and password the rss feed gets displayed.But with forms authentication turn on when i click the rss feed link i am getting redirected to the administrator login page.
If i set my authentication mode to none than the feed works like dream but the admin module do not work as it uses forms authentication.
How can i resolve the conflict for that one.I am using the asp.net mvc filter on my feed contoller to pop up the dialog box for the username and password.
I'm developing an internal booking sytem. Users log in to the sytem and can view existing bookings and search for bookings. They can also create new or edit existing bookings. When completing such actions I need a confirmation prior to completing the booking or updating the recorded. The confirmation is based on a reauthentication of the user.... in otherwords he needs to enter his passord again.
How can I achieve this? The system is internam and I'm using Forms Authentication. I an also using roles as som of the admin forms can only be viewed by administrators.
This could be very straight forward for some of you, but I got caught up. I am doing very simple test - browsing from IIS Manager to see the default page or "under Construction", however I am being challenged to provide my login credential . When I provide my login credential, I am able to see the default page. I wanted to see the default page without providing my credential since Enable anoymous access + basic authentication I am simply wanted to see the default page asit is working on other servers except this one. I have included screen print to make sure may question is clear.
both site1 an site2 are using form authentication and creating the token further adding in cookie as below,
FormsAuthentication.Initialize(); FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,username,DateTime.Now, DateTime.Now.AddMinutes(20),rememberMeSet,globalID ,FormsAuthentication.FormsCookiePath);
// Encrypt the ticket. String hash = FormsAuthentication.Encrypt(ticket); //Create the authentication cookie HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, hash);
My problem is when I'm logging in to Both site1 and site2 then these two are not running simultaneously on single browser using different tab for same user name.one is being logged out when logging to the other application and vice verse.
I set authentication mode to Windows in the web.config and I enable Windows Authentication and disable the Anonymous Authentication in IIS 7 on win 7, but HttpContext.Current.User is always null.It works fine when I host the web app in IIS 6.0.
I have a web farm web project, and want to make sure windows authentication is working well without any problem in web farm, can any one give me some web sites or information about that?
I needed information regarding the capabilities & integration of AzMan tool with Asp.net.Currently, I got a Sharepoint 2007 website along with ASP.NET 2008 where I am using Form Based Authenication.Now, the requirement is any user within a domain registered in AD should be able to login in website through intranet.
Can I acheive this using AzMan, or I need to create two websites one with FBA for internet users and the other one for the intranet users with AD authenication. Also my intenet website is deployed and in use where usermapping and roles are already created, so using this tool what will be the impact on existing webiste.
I want to implement Login session , in which one user can login from one device only ..and if on other device try to login with same ID the First Device get an Alert..
I'm trying to setup Forms Authentication in an asp.net mvc 2 application that will be hosted on IIS 6. There's an issue somewhere in my routing, but I can't pinpoint exactly where it is.
Here is the route entries I'm using to route the mvc requests through the aspx processing on IIS 6. These may or may not be the "right" way, but they do work on the server at current
So on my journey to become better at asp.net I've encountered a problem. I'm working on a login. I added some Style to it by adding a CSS file and after some time I made it look a lot better. Thereafter I added Asp authentication forms - which actually works great aswell except that if you're not logged in the CSS is not used. Once I've logged in and recieved a cookie I can go back to the login page and everything looks nice. But as long as I haven't "logged in" the page looks as if no CSS is used.
