You do not want to (can not safely) pass authentication information between the applications.
The only safe way to do this is to use an authentication manager. Instead of (or in addition to) logging into either application, the client authenticates to the authentication manager and is issued a token.
The applications must be able to accept the token from a user and then query the authentication manager to determine if the token (user) is valid (authenticated).
The application is then responsible for determining what permissions the user has in that application.
When a user accesses a protected application that uses the authentication manager, that application redirects the user to the authentication manager. Once the authentication manager has verified a user's identity, it forwards them back to the original application. The authentication manager attaches a unique ticket number to the URL of the protected application. The protected application sees this ticket. It sends this ticket to the authentication manager. The authentication manager tells the protected application whether the ticket is valid and if so, the user ID that was used to obtain the ticket. The protected application reacts accordingly, allowing access if the ticket is valid.
When you log into the authentication manager (say
https://www.domain.net/login/) a cookie is saved in your browser. This cookie contains a unique ticket number that identifies you to the the authentication manager application. Every time you access
https://www.domain.net/login/ after you are logged in, your browser automatically transmits this cookie to the application manager application. The authentication manager reads the cookie, looks up the ticket in its database, and identifies you.
The protected applications behave a little differently. Say you access
http://www.domain.net/application1/. When you load up that page, the page requires that you be logged into the authentication manager to access it. How does this work? The page redirects you to
https://www.domain.net/login?app=http://www.domain.net/application1/
Once the authentication manager has verified the user is logged in, it sends the user back to the URL specified in the app parameter with a ticket appended to the URL, like
http://www.domain.net/application1?ticket=McPZ4NKfx6S0EhnCEkHc
The protected application retrieves that the ticket parameter and queries the authentication manager:
https://www.domain.net/login/validate=McPZ4NKfx6S0EhnCEkHc&app=http://www.domain.net/application1/
The authentication manager server replies with a message that describes the ticket. In describing the ticket, the authentication manager would at a minimum state if the ticket is valid (the user is logged in) and provide the username associated with the ticket.
In short, when a user requests access to an application that is protected by the authentication manager, that user gets whisked away to the the authentication manager application. Once they are logged in, the client is returned to the application with a unique service ticket. This is a personalized ticket, good for only one use, and a short period of time that will gain you access into the application. The the authentication manager application independently communicates with the application manager application to verify this ticket and if everything checks out, it lets the user in.
<%
Dim authApp
authApp = "www.domain.net/login"
'Declare additional variables used for redirect
Dim protocol ' (http or https)
Dim protectedAppURL
Dim userID
'Determine the protocol for the originitating page
if Request.ServerVariables("HTTPS") = "off" then
protocol = "http"
else
protocol = "https"
end if
'Construct the protectedAppURL variable based on ServerVariables
protectedAppURL = protocol & "://" & Request.ServerVariables("HTTP_HOST") & Request.ServerVariables("URL")
'Check to see if the 'ticket' variable was passed via the query string
if Request.QueryString("ticket") = "" then
'If no, then redirect to the application manager
Response.Redirect("https://" & authApp & "/login?app=" & protectedAppURL)
else
'If yes, create MSXML object and attempt to validate the ticket
Dim xmlhttp, ticket, authMgrResponse, authMgrResponseArray
' shoud filter for bad input here!!!
ticket = Request.QueryString("ticket")
Set xmlhttp = Server.CreateObject("Msxml2.ServerXMLHTTP")
xmlhttp.open "GET", "https://" & authApp & "/validate?ticket="+ ticket +"&app=" & protectedAppURL, false
xmlhttp.send
authMgrResponse = xmlhttp.responseText
authMgrResponseArray = Split(authMgrResponse, Chr(10), -1, 1)
' yes = validate, no = not validated
if authMgrResponseArray(0) = "no" then
Response.Redirect("https://" & authApp & "/login?app=" & protectedAppURL)
else
userID = authMgrResponseArray(1)
'Response.write userID
end if
end if
%>
If your application has an existing login, you can modify the login to use the authentication manager (best) or modify it to ALSO accept tickets and use the authentication manager.
The authentication manager needs to verify the ticket is not expired (time limit). That time limit only needs to be long enough for both the protected application to respond and the authentication manager to validate the ticket...(milliseconds).
In .NET the first time a page is called, (which has not been precomiled and cached) the delay can be several seconds, so you ticket timeout should be large enough to support that for both the original app and the authentication manager app.
[/list]
