How can I share .net (C#) based authenticated session between web forms and MVC2 applications?

Question

We have a small application we built in our spare time using the latest mvc3 and Entity Framework .net libraries available at the time, and deployed it. The management liked it, and they want it integrated into a heavy legacy .net 3.5 web forms application.

I need to somehow use the same authentication sessions across the two applications. I am using the same DB and Application for authentication using the .net membership and profile providers. This works fine, but users have to login separately into the MVC app even when they are already signed in for the main application. I am open to any suggestions: enabling state session at a different level, or shared cookies, etc

What is the best way to bypass this login requirement and whether I should integrate the mvc application into the webforms or keep it as an independent application? My main concerns affecting the decision would be time taken for complete integration, and later maintenance of the applications.

score 7 · Accepted Answer · answered Mar 01 '11 at 23:17

First, the fact one application is ASP.NET MVC does make no difference here :)

Second, here is one example of what to do from MSDN:

http://msdn.microsoft.com/en-us/library/eb0zx8fc.aspx

Small snippet from that page:

<configuration>
  <system.web>
    <authentication mode="Forms" >
      <!-- The name, protection, and path attributes must match 
           exactly in each Web.config file. -->
      <forms loginUrl="login.aspx"
        name=".ASPXFORMSAUTH" 
        protection="All"  
        path="/" 
        domain="contoso.com" 
        timeout="30" />
    </authentication>

    <!-- Validation and decryption keys must exactly match and cannot
         be set to "AutoGenerate". The validation and decryption
         algorithms must also be the same. -->
    <machineKey
      validationKey="C50B3C89CB21F4F1422FF158A5B42D0E8DB8CB5CDA1742572A487D9401E3400267682B202B746511891C1BAF47F8D25C07F6C39A104696DB51F17C529AD3CABE" 
      decryptionKey="8A9BE8FD67AF6979E7D20198CFEA50DD3D3799C77AF2B72F" 
      validation="SHA1" />
  </system.web>
</configuration>

.

P.S.

StriplingWarrior's advice of merging both applications although not really required but may be very useful for future integrations. You may later end up doing it anyway.

+1 for also mentioning the machine keys - even if they are on the same machine, if the app pools are different, there will be problems if these aren't set. Your domain attribute should actually read `.contoso.com` - you won't be allowed to set cookies with only one period. — Zhaph - Ben Duguid, Mar 02 '11 at 00:36

score 2 · Answer 2 · answered Mar 01 '11 at 23:16

Forms authentication uses cookies to track users. Cookies can only be shared between the same domain. So for example if you had app1.foo.com and app2.foo.com simply configure those two applications to share the same domain cookie. For example both web.config should share the same forms authentication configuration:

<authentication mode="Forms">
  <forms 
      loginUrl="~/Account/LogOn" 
      timeout="2880" 
      domain="foo.com" 
  />
</authentication>

You also must ensure that both application share the same machine keys because an authentication cookie emitted by app1 needs to be decrypted by app2 with the same keys.

Your domain attribute should actually read `.foo.com` - you won't be allowed to set cookies with only one period. — Zhaph - Ben Duguid, Mar 02 '11 at 00:35

score 0 · Answer 3 · answered Mar 01 '11 at 23:14

0

You may want to consider simply integrating this application into your Web Forms application directly. The two can coexist in the same application.

answered Mar 01 '11 at 23:14

StriplingWarrior

151,543
27
246
315

score 0 · Answer 4 · answered Mar 01 '11 at 23:18

0

Store the session state in a database. Store the session key in the cookies of each sessions. At the AcquireSessionState event in the life cycle's of both applications, get the session id from the cookie, load the session data from the database and update your HttpContext.User. You will then have the same authentication data in both applications.

answered Mar 01 '11 at 23:18

smartcaveman

41,281
29
127
212

You could just set the `sessionState` Mode to `SqlServer` or `StateServer` and the framework will take care of all of this for you (serialising session to a database, storing the session key in a cookie, etc.): http://msdn.microsoft.com/en-us/library/ms178586.aspx – Zhaph - Ben Duguid Mar 02 '11 at 00:41
This does not sound accurate. If I recall correctly, the session would be stored in association with an Application ID. Since he is running two separate applications, this would not resolve the same data. – smartcaveman Mar 02 '11 at 16:51

How can I share .net (C#) based authenticated session between web forms and MVC2 applications?

4 Answers4

Linked