ASP.NET自定义身份验证处理

Question

We have a web app written by a third party in ASP.NET, we don't have access to the source code but do have access to the server it runs on. We now have had a new public website developed for us in PHP and need to add a login to the homepage that will allow users to access out ASP>NET app. Any ideas on the best way this can be achieved? Can we write a custom authentication handler to do this?

Answer 1

So authenticating from PHP by making a POST request to an ASP.NET application? And without having code access? AFAIK you'll be restricted to using HTTP methods rather than anything else to broker the request.

The key is making the POST operation and consuming the response from ASP.NET and passing that to the client-side. I have tried this before but this was using an ASP Classic page with the request being generated from a winforms application. The principal is reasonably easy, POST over the username, password and associated details; then write out the authentication cookies. ASP.NET Forms Authentication will generate at least one cookie whose default name is '.ASPXAUTH', you may also find the session cookie ('ASP.NET_SessionId') depending on how the site handles sessions. One nice way of monitoring things is using Fiddler to see what is passed and returned back and forth.

However, the problem I can envisage is your PHP page will be writing out the cookie for the domain hosting your PHP code and if the two sites are not co-existing in the same primary domain then while you might successfully authenticate, the ASP.NET site will not be able to read cookie created from a different domain. You might be able to get away with the php and ASP.NET servers running in the same sub-domain using the 'enableCrossAppRedirects' but this is something I'm not overly familar with.