Re: FormsAuthentication Class Question

From: Joe Reazor (joenospam_at_belgor.com)
Date: 05/28/04 

Date: Fri, 28 May 2004 16:40:04 -0400

This is getting frustrating. In trying to implement a custom
encryptor/decryptor using RijndaelManaged class I found out that I can't
directly encrypt a FormsAuthenticationTicket when I am outside of a webforms
application. The stack trace yielded the same issue I saw before where the
call to FormsAuthentication.Initialize that happens somewhere in the .net
runtime fails, I'm guessing because I'm outside of a forms app. Its
annyoing though because I just want to use the ticket and its data. I guess
I can ignore trying to return a ticket from my custom class and just provide
access to the ticket's data that is stored in the encrpyted cookie.

In just thinking about it some more. I probably could just as easy go back
to using standard FormsAuthentication encryption of my ticket, let my custom
httpmodule use that for the begin authentication event to confirm the user
is authenticated and on the login page I just add some extra code to encrypt
just my username field as a separate cookie. Then I can access this in a
custom class that is called through interop by my asp page and return it the
username. Then on the asp side I can write my code to use that username to
get user data from my SQL tables.

Does that seem to make more sense?

==============
Joe Reazor
Gorbel Inc.
email: joerea=AT=gorbel=DOT=com

"Joe Reazor" <joenospam@belgor.com> wrote in message
news:OZDcQKOREHA.2404@TK2MSFTNGP09.phx.gbl...
> Thanks Luke, I was afraid that was going to be the answer. The thing that
I
> am getting stuck on now is that if I don't use FormAuthentication.Encrypt
> and instead do the encrypt myself, I'm not sure what this Encrypt method
> does? You pass it an authentication ticket and it returns an encrypted
> version. How exactly do I reproduce that but with my own class?
>
>
> ==============
> Joe Reazor
> Gorbel Inc.
> email: joerea=AT=gorbel=DOT=com
>
>
> "[MSFT]" <lukezhan@online.microsoft.com> wrote in message
> news:0tbpYF5QEHA.304@cpmsftngxa10.phx.gbl...
> > Hi Joe,
> >
> > I think you have to create customized encryption/decryption under this
> > situation. For example, with CryptoStream in .NET. You may take a look
at
> > this article for this:
> >
> > Encrypting Data
> >
>
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/htm
> > l/cpconencryptingdata.asp
> >
> > Luke
> > Microsoft Online Support
> >
> > Get Secure! www.microsoft.com/security
> > (This posting is provided "AS IS", with no warranties, and confers no
> > rights.)
> >
>
>

Relevant Pages

  • Re: WSE 3.0 Policy and Encrypting Custom Headers (XML Encryption S
    ... We made a custom assertion, which encrypts custom headers using X509 ... >>> easier to encrypt custom soap headers to conform to the Xml Encryption ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Force user to use outlook and custom organizational form
    ... Encrypted messages using custom forms are ... not compatible with mail clients other than Outlook. ... IPM.Note messages before you sign or encrypt them. ...
    (microsoft.public.exchange.development)
  • Re: WSE 3.0 Policy and Encrypting Custom Headers (XML Encryption S
    ... >> easier to encrypt custom soap headers to conform to the Xml Encryption ... >> localization header, etc). ... WSE 2.0 does allow the body and username ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Please Help me- Creating Custom tokens
    ... But i guess that deals with the client sending a custom token obtained ... from a token issuer and using that to encrypt and sign the requests.. ... >> encrypted token from the server to the client. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Force user to use outlook and custom organizational form
    ... >> IPM.Note messages before you sign or encrypt them. ... Internal users need to see the custom user ... > Setting the mesage class back to IPM.Note will cause the message to loose ... > If you want a smart answer, ask a smart question ...
    (microsoft.public.exchange.development)