RE: Strange behavior using SSL and "FORMS" authentication.

From: Paul Glavich (glav_at_aspalliance.com-NOSPAM)
Date: 01/07/04

  • Next message: Paul Glavich: "Re: securing data access via website"
    Date: Tue, 6 Jan 2004 20:19:09 -0800
    
    

    No, that would not be the reason you are having the
    problem, otherwise you would not even get the login page
    (as I assume you have SSL for the whole site, not just
    some pages) which means the login page is also protected
    by SSL. Try doing a bit of tracing and output the
    credentials you receive to a trace file, to see what you
    are getting.

    HTH,
    - Paul Glavich

    >-----Original Message-----
    >Hello,
    >
    >Searching similar questions (keyword= SSL, in the
    ASP.NET newsgroup), I found an argue about similar
    situation. Something gets my attention, they were
    discussing about creating self-signed certificate (like
    is my case):
    >
    >>>>ITEM: SSL and ASP.NET, from 10/12/2003
    >Is about a developer that he doesn't know like create a
    self-signed certificate.(This not apply for me).
    >
    >>>>ITEM: ASP.NET and Secure Socket Layer, from
    11/20/2003
    >They recommend to review the following articles:
    >
    >INFO: Help Secure Forms Authentication by Using Secure
    Sockets Layer (SSL)
    >http://support.microsoft.com/default.aspx?scid=kb;en-
    us;813829
    >
    >INFO: Building Secure ASP.NET Web Applications Guide
    >http://support.microsoft.com/default.aspx?scid=kb;en-
    us;330246
    >
    >I had used both of them, I have made all that suggests.
    >
    >I have everything well configured, but when I'm
    accessing to the secure page, the security alert show me
    the following:
    >
    >-(ok) The security certificate is from a trsuted
    certifying authority.
    >
    >-(ok) The security certificate is valid.
    >
    >-(!) The name on the security certificate is invalid or
    does not match then name of the site.
    >
    >Is possible that the last alert is my problem?
    >
    >Thanks in advance...
    >
    >gmarquez
    >
    >
    > ----- gmarquez wrote: -----
    >
    > Hello,
    >
    > I am using "FORMS" authentication, without SSL the
    behavior is normal, everythings working very well.
    >
    > When in IIS I cheking "Require SSL" (in Secure
    Communications property), I can't to do login, after
    introducing the credentials, I am redirected to login's
    page again, If I take the SSL's Check off in the ISS
    property, everythings will work very well again.
    >
    > NOTE: I have a valid certificate well installed.
    >
    > What is happening?, some suggest?
    >
    > Thanks in advance...
    >
    > gmarquez
    >.
    >


  • Next message: Paul Glavich: "Re: securing data access via website"

    Relevant Pages

    • Re: Ace Password Sniffer : How does it work ?
      ... >> Another protocol that offers same is IPSec. ... >> authentication and secure transfer of data between server and client ... >> would be pretty hard to use SSL to secure data exchanged between ... Once you are done with the secured login, ...
      (microsoft.public.security)
    • Re: SSL php code
      ... > Sean I am planning on exclusievely using secure pages (ssl) after the user requests to login. ... This will securely redirect to a login ...
      (comp.lang.php)
    • Re: How to use SSL for login page only
      ... If you just secure the login page, ... an SSL connection. ... Joe Kaplan-MS MVP Directory Services Programming ... I would then like to have a link to a login page so I can authenticate ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • Re: From http:// to https://
      ... > I have a login page that is secured with SSL and other non secure pages ... As Server.Transefer or response.redirect takes http by default. ... > standard method to transefer pages from normal to SSL page and vice versa. ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: security alert
      ... that is an security alrert to let the end user know that the site they are ... careful with your data being transactions as the program using ssl (secure ... "the security certificate has expired or is not yet valid". ...
      (microsoft.public.windowsxp.perform_maintain)