How to use ASP classic authentification with ASP.NET?

Question

I have a web application which is implemented in ASP classic. Now we want to move to ASP.NET but as the application is quite big we can't migrate at once. Instead we decided to move there gradually adding and replacing ASP.NET bits.

I know that it it possible to use ASP.NET authentication with ASP classic as described here: http://weblogs.asp.net/scottgu/archive/2007/03/04/tip-trick-integrating-asp-net-security-with-classic-asp-and-non-asp-net-urls.aspx

What I need is exactly opposite. Is there a way to secure ASP.NET pages using our ASP classic authentication system? If there is no standard way to do it, how would you implement such thing?

Thanks

You are far better off just rewriting the authentication so that it is .NET based. It will take less time, too. — Paul Alan Taylor
There is no standard Classic ASP authentication. You must have something custom. — John Saunders

Michiel van Oosterhout Michiel van Oosterhout · Accepted Answer · 2011-12-08T23:03:33

If you can encrypt a valid ticket in your Classic ASP code in such a way that the ASP.NET FormsAuthentication module can decrypt it, then a user with such a ticket (stored in a cookie or in the URL) will be considered authenticated in the ASP.NET request pipeline.

Here is the documentation on how to manually encrypt using the static FormsAuthentication.Encrypt method:

http://msdn.microsoft.com/en-us/library/system.web.security.formsauthentication.encrypt.aspx

This illustrates that the ticket is really nothing special, basically the user name, expiration date. Note that you also store some extra user data in the ticket.

Of course, that still doesn't give us the actual encryption algorithm. This depends on the configuration in web.config, specifically the <machineKey>-element. You should explicitly set the decryptionKey attribute, because you need to use the same key in your Classic ASP code.

MSDN: machineKey element

And you should also set the decryption attribute so that you can use the same algorithm in your Classic ASP code (like DES for example). If necessary you can create a custom decryption algorithm if you can's support the built-in ones in your Classic ASP code.

You would end up with a configuration like this:

<machineKey decryptionKey="your key here" decryption="DES" />

That is how I would implement it.

How to use ASP classic authentification with ASP.NET?

1 Answers