Let's say I'm currently authenticated in an application (namely: applicationA) and I click a link that will take me to another application (namely: applicationB). Is it correct that in order to bypass authentication of applicationB, I'll just create a ticket for that application telling the web server that I'm already authenticated?
View 5 Replies
if it is possible to use a WCF Dataservice as the MemberShipProvider for a forms auth application. I have written code for a provider (below), but I do not know what to do as far as a connection string, or any other web.config properties.
Please Help!!! Here is the code for my provider, anytime it says Odbc that is because I based this off of the custom Odbc provider on the msdn site. The only ACTUAL references to any odbc connection are in the comments:
[Code]....
Been scratching my head on this one today quite a bit. Time to ask the guru's.Implementing your basic Forms Auth for a 2.0 web app in conjunction with SQL Membership Provider and Role Provider. Web.Config from virtual directory root
[Code]....
All other subdirectories do not contain web.config files but rather wanted them to just work off inheritence from the root web.config. Upon publishing of this setup - I am having one hell of a time maintaining the user 'authenticated' state. (Not sure if that's the best explanation of what is going on.. but)
i have a secure ASP.net application ,login page and all these stuffs, i want to create a windows desktop application for some resones but i want to use the same security of the asp.net , is there anyway to get the login information of the asp.net to login to my windows desktop application?
View 1 RepliesIf I have following code in my web.config file
<authentication mode="Forms">
<forms name="appNameAuth" path="/" loginUrl="login.aspx" protection="All" timeout="30">
</forms>
do I still have to create "Ticket" manually in code behind to actually create a login ticket as:
[code]....
We're running IIS7 and have windows authentication enabled. Everything else is disabled. When we go to the page though, we aren't prompted for a windows logon, but are redirected to the default forms authentication login page (Accoun
View 1 RepliesI need this up and running quick but I spent the last few hours researching/worrying about which would be better:
Asp.net Forms Authentication
vs
Custom Header Token:
On the server
[code]...
I am developing a asp.net application using SQLServer 2008 and I have a page "Default.aspx" in which i have userID and Password textboxes and a SUBMIT button. Here is the script I am using to authenticate.
[Code]....
Well now i want to know that by using FormAuthenticationTicket how can I check on other pages if user is authenticated user cause in the URL if i just change the page like "Main.aspx" and hit it takes me there which should not happen and redirected to Login page.
How should i check on every page on page load event if user is authenticated or not and if not then redirected to Login.aspx.
I have done some research and tried to find answers on how to integrate forms authentication with ASP.NET but all I can find is for 2.0. I don't mean to sound ignorant or annoying about it, but does anyone have a quick link to somewhere where I could find out how to integrate a custom SQL Server DB (with username, password, id, etc columns for user) with ASP.NET 4.0?My application is actually a Silverlight Business Application where I am trying to log in/register users in a separate Database in a SQL Server 2008 engine
View 1 RepliesI have a asp.net application where i am using FormAuthentication Ticket when user Sign in....on each page I want to check if FormAuthentication Ticket has expired ...how to do this ?..
View 6 RepliesI have a web app that uses window.openModalDialog to display a page. This page has a hyperlink that connects to an HttpHandler to retrieve a file. The link has a target property of "_blank". We've recently implemented Forms Authentication on this site in place of a flaky proprietary solution and we are noticing that now whenever we click on that link we get a pop-up window and the login screen appears.In the authorization section of the web.config we're saying that we don't want to allow anonymous. However, if I add a location element with the URL the handler is associated with, I can hit the breakpoint in the ProcessRequest method because it doesn't care if I'm not logged in. What's odd is that I should be logged in so it seems that the authentication ticket (which isn't expired yet) isn't being accepted in the popup window. If I allow anonymous I can bypass this problem, however the code that retieves the file relies on Session data and it's null. Therefore, either way I can't get this to work.It has been suggested that instead of a modal dialog just use window.open, however I'm reluctant to do that because when this window is open I don't want users accessing the parent window due to several reasons. Is there any way to get around this problem? I don't want to ditch forms auth for the old way because it wasn't secure.
View 1 RepliesI am working on a site that uses windows authentication, but I have one page for password resets that I want to allow anonymous access to.I have tried doing authorization, allow users="*", but it doesn't appear to work with this.Do I need to have another seperate site for this section?
View 2 RepliesI'm trying to setup my IIS 7.0 MVC2 site but having problems.I want to use Integrated Security so that the app can obtain the user's credentials. We can then do a look-up of some AD groups to determine what they can do from that point onwards.The problem is - Every time we browse to the application, instead of navigating to our main page immediately, we get a login prompt provided by IE. I've read that we need to make sure that in the browser's Tools->Options->Advanced-> (Securiy-> ENable Windows Intagrated Security) must be checked - which it is on ALL 3 machines where I try this.
The machines AND the server are all in the same domain.My config file states <authentication mode="Windows" /> and I've tried every combination for <identity...> and <authorization...> but to no avail. I can only get the "login" prompt to go away if I enable Anonymous Authentication - but then I can't detect the windows user or their group membership.
I am having difficulty deploying a Silverlight 4 RIA services Web app to IIS 6 on Windows Server 2003. The application works fine when running on the development server. However, when deployed to a production server, all the Web service calls redirect to the login page.
Here are the details:
The site uses forms authentication. Login is via an ASP.NET Web page; the Silverlight application does not have its own version of the login page. Login is working correctly.
as there is so much code a built a demo project
Specs:
MSVS 2005
asp.net 2.0
ajax Enabled site
MS SQL server 2005
User/logon On server required name: MyDBLogon, access to project database MyFormsAuth
Download project from here : http://www.screencast.com/t/ZmE3ZWM4ZDMt(NOTE: Select 'Download this media' as the top of page) Also I use the FREE trial demo of this tool : http://www.qualitydata.com/products/aspnet-membership/download.aspx
Project : The Member logs on with email address and password.
admin logon is : admin@yahoo.co.nz, password is 12345
The issue: I use Logonview control to show menu for each role type. See 'controls' folder.
When You first run the project you will see it in the main page...LIke
"Admin, Members, MembersX, Welcome etc"
Logon..it works fine.
The test.. close browser, to test Authentication ticket cookie.
Re run view project ( we are now testing the forms authentication process as cookie is being read to see if authentictaion is still active).
When the page runs, and authenication is active, proven by going to public page IsAuthenticated=true", fine, BUT The page direction usercontrol ( ie logonview control) is not visible, it doesnt work on the new browser run ??
here's what I have:
My asp.net 3.5 app uses Forms Authentication.
I create an authentication cookie (ticket) with an expiration date of one day.The cookie'sIsPersistent is set to true.
I do not use any session variables.
Session timeout is the default 20 minutes.
Here's the problem:
When the session times out in 20 minutes, the user is redirected to the logon page even though the authentication cookie has not expired.
Why does this happen? I thought the cookie and the session worked independently. Shouldn't the user remain logged in as long as the cookie hasn't expired?
i have a custom class has extra information about my users , i want to create an object of this class and attach it to current Authentication ticket , what is the best way to do that , i have read there is a userdata thing in the authentication ticket but it's type is String
View 5 RepliesIs it possible to request an X509 certificate from a client without configuring the application to use Windows Authentication? The purpose would be to press an asp.net button and "digitially sign" a web-form's contents. I do not need any login information, just the X509 cert.
View 1 RepliesI am developing a web application which implements membership, roles and profiles. I also want it to be multi-tenant / multi-domain. By this I mean that I will have hundreds of domain names pointing at the same web application. I want users to be able to create accounts at each individual domain. I want the opposite of "single sign on". I want users to be able to use the same username, email address and password (or different ones, at their choice) to create accounts at the different sites. I do not want users to have any awareness that the different domains have any relation to each other as they will look different and have different content. The first problem I run into is that usernames have to be unique within the forms auth aspnet db.
Well, if they want to use the same username to register on 10 different sites then I need to support that. My first thought was that instead of identifying a user by their username, I need to extend the aspnet tables and sprocs to consider the username + a unique site identifier. Is there any sample code or has anyone else ever done this before? Should I just abandon the built in aspnet forms auth and roll my own custom auth scheme? The data on the sites is not sensitive so security isn't really that important to me.
I'm having a problem trying to delete the form authentication ticket (.ASPXAUTH) from the server side. It would be the same to delete or invalidate the ticket so the client could not reuse it.
So far, the only solution I've found is to delete the ticket from the client side (through a "Set-Cookie: .ASPXAUTH=;") but nothing seems to be implemented and/or working for doing so in the server side. The final idea is that if someone steels that ticket
In particular, I'm working in C# but as it's rellated to the Dotnet Framework any implementation of the solution would be OK; I tried all the possible things and nothing worked out, even invalidating the session but nothing.
we recently upgrated our project from 1.1 to 2.0. since then we are seeing "Forms authentication failed for the request. Reason: The ticket supplied has expired" in Event Viewer. this keeps coming 1-2 times for every minute. this is the full message. this also made the response time increased it seems.
Event code: 4005
Event message: Forms authentication failed for the request. Reason: The ticket supplied has expired.
Event time: 1/25/2010 5:00:30 PM
Event time (UTC): 1/25/2010 10:00:30 PM
Event ID:
Event sequence: 20601
Event occurrence: 2692
Event detail code: 50202.....
I have a web application. This application needs to perform a search on folders located on 2 different machines. I can use impersonation for this. But -
a. I don't want to use network service account
b. I want to impersonate just the search part of the code.
c. Specifying encrypted user name / password in web.config is one option. But this would be the last option.
Can I use a custom service account for the application pool for this? If yes, then how to impersonate a specific part of code using this?
I am wanting to from now on create a backdoor entry for every web application I build so that if need be I can shut it down.I had a nasty recent experience of a client not paying the bill, however the application was on his server, so when I used my backdoor access to alter a hidden record in one of my database tables to stop it from running, they had full control of the server and were able to look through ther SQL log and see what queries had been run at that time and then alter the record and prevent access to the table...
The only way I can think of that will be full-proof no matter where application is (providing there is web access), is to have ONE webservice running on my server with all apps listed, with a secure interface and the ability for me to turn off any application. Then every day, once a day, each of my client's applications (no matter which server they are on) communicates with this web service to see if it is allowed to run by referencing a GUID. This once a day check would be compiled into the main app DLL.
I need to create an application with Forms Authentication and/or Windows Authentication. If the application is set to use mixed authentication (Forms + Windows Auth) and the user don't have a Windows user account, the login will fail and he must be redirected to a forms login page. How can I do this?
Are there any different way to provide mixed authentication?
I have an application which is installed on local pc and is using SQL db. It is a client management system where I want to add capability to register new clients and give them access to my web site which is sharing the same SQL database with local application.
At the moment clients can register on the web site and I have ASP.NET authorisation system set up with aspnetdb_user, aspnetdb_membership and etc tables. But sometimes it happens that I need to register clients on my local application on PC and ideally would like that registration to create online account for the client as well. Then I want to be able to send him user id and password by email and let him know that he has been registered in my database and online account is ready for him as well.
Basically I want to have full synchronization between asp.net membership service and local application through SQL db. As I said both online and local apps are shareing the same SQL database. what would be the best practice to implement it.
