CODEWITHSUNDEEP
asp.netasp.net-mvcasp.net-mvc-3asp.net-mvc-4webforms
urlreader
urlreader

Reputation: 6615

How To Pass UserIdentity/UserName From WebForm application to MVC5 Application?

I have a asp.net webform application (ProA). It was built some time ago by someone else, although I can access source code. Now, I finished another application which is a MVC5 (ProB).

ProA uses asp.net membership for authenticate users. ProB is not using any membership. Now, we want to add user authenticate to ProB, and also some parts of ProB is using username as parameter for some data.

Now, we want to force user login from ProA, then maybe click a link/button, redirect the user to ProB. In ProB, we create an authorize filter to verify the user has the right, then show the pages.

I have tried to use forms authentiction across applications, described in: Forms Authentication Across Applications . But it does not work. The changes I made in web.config is:

<authentication mode="Forms">
  <forms name="X.ASPXAUTH" loginUrl="~/Login.aspx" path="/"
              protection="All"                  
         enableCrossAppRedirects="true"
  />
</authentication>

Could it be because that one is webform and the other is MVC? Also, ProB actually does not have any membership installed yet, does it affect this form authentiction?

Any other suggestions?

Thanks.

--- Added more info:

1) I'm testing on my local machine. I run both sites in VS2012. What should I use for domain? "localhost"? ".localhost"? or, not use domain at all? seems not working.

2) I added a button on ProA, when clicked, use this redirect to ProB:

HttpContext.Current.Response.Redirect("http://localhost:12345/", false);

Is this the correct way? The HttpContext has the user identity.

3) Does ProB have to have membership? Now, ProB does NOT have membership feature, is it the reason?

Upvotes: 0

Views: 571

Answers (1)

Brent Mannering
Brent Mannering

Reputation: 2316

You shouldn't have any issues with sharing the authentication across web forms and MVC apps. The underlying technology is the same, .Net uses an encrypted to cookie which has the forms auth ticket.

Read the following MSDN article: https://msdn.microsoft.com/en-us/library/eb0zx8fc.aspx

The main things to note are the domain reference and the machineKey config. The domain attribute of the forms auth config allows the browser to include that auth cookie with the requests sent to each site. Then the machineKey portion is the part that handles the encryption/decryption. Both sites must have the config setup up identically for this to work, and also be running on the same domain i.e. xyz.contoso.com and abc.contoso.com

web.config 

<configuration>
  <system.web>
    <authentication mode="Forms" >
      <!-- The name, protection, and path attributes must match 
           exactly in each Web.config file. -->
      <forms loginUrl="login.aspx"
        name=".ASPXFORMSAUTH" 
        protection="All"  
        path="/" 
        domain="contoso.com" 
        timeout="30" />
    </authentication>

    <!-- Validation and decryption keys must exactly match and cannot
         be set to "AutoGenerate". The validation and decryption
         algorithms must also be the same. -->
    <machineKey
      validationKey="[your key here]" 
      decryptionKey="[your key here]" 
      validation="SHA1" />
  </system.web>
</configuration>

EDIT

Use the following link to generate your machine keys: http://www.developerfusion.com/tools/generatemachinekey/

Upvotes: 2

Related Questions