Re: forms authentication across multiple web servers

From: Dominick Baier [DevelopMentor] (dbaier_at_pleasepleasenospamdevelop.com)
Date: 11/24/05 

Date: Thu, 24 Nov 2005 08:43:12 -0800

Hello Roel,

this only works if the servers are in a contiguous domain namespace...sorry.
You are out of luck here.

ASP.NET 2.0 supports cookieless forms authentication. Your scenario would
work there.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

> Hi Dominick,
>
> Thanks for your answer.
>
> The domain names differ completely:
>
> Server 1=
> dev.xxx.biz
> Server 2=
> devnet.yyy.be
> I will check the domain attribute.
> should I set domain= .yyy.be in the web.config of server 2 and xxx.biz
> in
> the web.config of server 1 ?
> Roel
>
> "Dominick Baier [DevelopMentor]"
> <dbaier@pleasepleasenospamdevelop.com> wrote in message
> news:4580be6314c8ee8c7bf30365b41a8@news.microsoft.com...
>
>> Hello Roel,
>>
>> what are the names of the machines from a client (=IE) perspective...
>>
>> A RFC compliant browser does not send a cookie form
>> serverA.domain.com to serverB.domain.com - you have to adjust the
>> domain attribute in the <forms> configuration to ".domain.com" -
>> this means IE sends the cookie to all servers under the "domain.com"
>> namespace.
>>
>> though i am not sure if this is already there in 1.1 - otherwise
>> issue the cookie manually and set the .Domain property
>>
>> ---------------------------------------
>> Dominick Baier - DevelopMentor
>> http://www.leastprivilege.com
>>> Hi,
>>>
>>> I want to provide a single sign on for 2 web applications hosted in
>>> different environments.
>>> I set the machinekey to the same value in both web.config files
>>> (also
>>> i set
>>> them to the same value in the machine.config files). The
>>> <authentication
>>> mode="Forms" > section is exactly the same in both applications:
>>> <authentication mode="Forms" >
>>> <forms name=".EuphAc" loginUrl="Main/loginForm.aspx"
>>> protection="All"
>>> timeout="60" />
>>> </authentication>
>>> The only time this works is if I do it on the same physical machine:
>>> 2
>>> web applications sharing the same machinekey in web.config section
>>> and
>>> <authentication mode="Forms" > section.
>>> If I try the same moving application 2 to another server (including
>>> the web.config file which stays the same), or to localhost, I can
>>> login on one system but it does not login on the other system.
>>>
>>> (Strange thing was it sometimes seemed(!) that it worked but after 1
>>> second it redirected me back to the login page.)
>>>
>>> I hope I'm somewhat clear.....
>>>
>>> What am I doing wrong ?
>>>
>>> Any help much appreciated!
>>>
>>> Roel
>>>

Relevant Pages

  • Re: error code 0x80072EFD
    ... [CallerId = AutomaticUpdates] ... cookie, reporting URL = ... the server with hr = 80072efd. ...
    (microsoft.public.windowsupdate)
  • Re: Login for access to certain pages or parts?
    ... I know roughly what an .htaccess file is and I have access to more than this on my own server, but not more on commercial servers that host various sites I have made or maintain. ... The successful login routine sets the cookie by testing to see if the password the user has entered matches the one in your database for that user. ... For pages that can be accessed by multiple groups, your authorize function could be passed a comma-delimited list of allowable groups for that page. ... // Authorizes user based on group, redirects if necessary. ...
    (alt.php)
  • Chicken and egg issue with Cookie based login?
    ... I have few questions I hope someone can clear up for me with the cookie ... private web server. ... It also says this about the secret key: ... Second, would be an example of the "Session ID" or more general, what is an ...
    (comp.security.misc)
  • RE: Proof of Concept Tool on Web Application Security
    ... You are misreading the script fragment that you quoted. ... What that is intended to do is fetch an image from a server under your own ... and reacting when it sees a new cookie. ... But this require interaction of victim, ...
    (Pen-Test)
  • Re: Getting 12209 error on isa when server tries to connect to cookie enabled site. Xp workstation w
    ... What leads you to a conclusion that this problem is an ISA server related? ... We try to access a certain site which sets cookies by sending cookie ... 2.The conclusion is that when Cookie header is sent from the server to ...
    (microsoft.public.isa)