ASP.NET VB.NET Remote Login Portal Setup

问题:

Technology ASP.NET, VB.NET 2.0 (soon to be 4.0)

Overview I'm writing a Login / Authentication Portal, so that a web application can use it to login a user, and then they can use the application using their credentials.

The login portal will be a separate application, and initially only available via an extranet as well as intranet for certain applications; but future apps will need to authenticate via the web (happy to implement as a separate instance). I basically want other individual applications to be able to authenticate users via this portal.

So that...

1. A user goes to an application's web url (i.e. www.application.com / http://apps/application - intranet) and clicks "login".
2. User's browser is redirected to the portal application, with a query string www.loginportal.com/login.aspx?url=www.application.com/login.aspx (or other page).
3. User fills in their credentials (username, password), and clicks "login" button.
4. Browser redirects back to url i.e. www.applications.com/default.aspx or login.aspx and is authenticated and logged in; and can use app.

Completed I have the authentication itself sorted, and will implement as a class library in the local applications via a dll.

Need So I basically need to know, how to:- 1. Post data to the portal url (could be different domain). 2. Redirect browser with post. 3. Make sure that the authentication is secure, and not easily hackable (I know how to use urlencode and htmlencode etc) - just not sure about implications of posting data across domains.

Any help greatly appreciated...

Cheers, Duncan.

回答1:

Seriously tough stuff, here. If it were me, I'd lean heavily on Windows Identity Foundation. I believe it can support this scenario (haven't actually done it; someone else at my company is developing against it).

回答2:

OK, so this is the solution I ended up using:

In the original application (the one that needs the authentication; step 1 above) I redirect the user to my login portal, and include the original url as a get parameter. The user then types in their details, username and password.

Next, the server-side code authenticates them, and redirects to a new page, where I send back to the page an html form which includes the request datetime (for security) along with a encrypted string (including the datetime of the request) of the data I want sent back to the original form.

I also add a JavaScript post method which sends the data to the original url as a form post. Because I'm using the same class library at both ends, I can encrypt and decrypt the data using the same method and the original requesting application has all the user data, including the ability to check the datetime of the request (I allow a set amount of time between the authentication and the picking up by the original app, making sure these are within say 5 minutes.

And job done.

If anyone wants the code, I can provide it, just don't have it with me at the moment, if I remember I'll post it.

Not the most elegant solution, but it works, and it's secure, so I'm happy. :).