ASP.NET Site Authentication Cookie sharing

Question

I've got 2 MVC3 Internet websites. One (Site1) uses Windows authentication and is in the Local Intranet Zone. The second (Site2) is publicly available and uses Forms Authentication. Both sites are in the same Domain, but have a different sub-domain. I want to share authentication cookies between the two. In order to do this, they need identical settings in the web config. Sometimes this works, most of the time it doesn't. If anyone hits Site1 from outside our network, they get a 403 error, which is good. If a network user hits Site1, they're allowed in based on their network credentials. I then check their user's roles with the code below.

var userName = string.Empty;
var winId = (WindowsIdentity)HttpContext.User.Identity;
var winPrincipal = new WindowsPrincipal(winId);

if(winPrincipal.IsInRole("SiteAdmin")) {
    FormsAuthentication.SetAuthCookie("siteadmin", false);
    userName = "siteadmin"; //This is a Forms Auth user
}
else if(///I check for other roles here and assign like above)

Once I've checked the roles, I forward them onto Site2, creating a cookie for them if the user is in one of the roles determined in the if...statement above.

if(!string.IsNullOrEmpty(userName)) {
    //Add a cookie that Site2 will use for Authentication
    var cookie = FormsAuthentication.GetAuthCookie(userName, false);
    cookie.Domain = FormsAuthentication.CookieDomain; //This may need to be changed to actually set the Domain to the Domain of the TVAP site.

    HttpContext.Response.Cookies.Add(cookie);
}

//Network users not found in roles will simply be forwarded without a cookie and have to login
HttpContext.Response.RedirectPermanent(tvapUrl);

I've set up in the web.config a matching MachineKey (validationkey, decryptionkey and validation) for each site.

They also both have the same authentiation settings, with the exception of the mode. So my config for this looks like this.

    <authentication mode="Forms">
      <forms loginUrl="~/Account/LogOn" name=".ASPXFORMSAUTH" protection="All" path="/" domain="mydomain.com" enableCrossAppRedirects="true" timeout="2880" />
    </authentication>

I think my problem is that the 'authentication' mode is different for each one, so Site2 won't use the authentication cookie from site1. This is just a guess though. Is there anyway I can figure out the issue?

According to this article, what I have going here should work. And there have been times where I think it's worked, but it's hard to tell, as I may have cookies cached and their getting reused. I'm hoping someone can see something I'm missing here, or has an alternative solution.

UPDATE I checked my authentication cookie on Site2 after logging in normally and found the Domain wasn't set, so I've removed that line of code. Also, I read about cookies expiring when the date isn't set, so I set an Expire Date on my cookie before sending with the request.

So, with those two changes, here's where I'm at.

It works on Chrome and Firefox, but not with IE. Not sure. I'm going to do some additional testing from another machine and another user so I know I haven't got any residual cookies sitting around.

Jeff Reddy Jeff Reddy · Accepted Answer · 2011-09-26T11:48:11

I determined my problem was not setting the Expires property of my cookie. According this Microsoft article, cookies won't be written to the client unless the Expires property is set.

"If you do not set the cookie's expiration, the cookie is created but it is not stored on the user's hard disk. Instead, the cookie is maintained as part of the user's session information. When the user closes the browser, the cookie is discarded. A non-persistent cookie like this is useful for information that needs to be stored for only a short time or that for security reasons should not be written to disk on the client computer. For example, non-persistent cookies are useful if the user is working on a public computer, where you do not want to write the cookie to disk."

In this case, I needed the cookie to be written to disk since I was doing a server transfer to another site, thereby ending the session for that user. I'm not 100% sure that this was the fix, but it is working now, so I'm assuming that.

ASP.NET Site Authentication Cookie sharing

1 Answers