Forms Authentication and using Current User Credentials programmatically

Question

5.00/5 (2 votes)

See more: (untagged)

Using Forms Authentication and locking down the path so you need to be authenticated to access the pages / data.

I am trying to use the current authenticated user credentials in order to process a web request within the .aspx page that the user has navigated to. Code as below:

HttpWebRequest req = (HttpWebRequest)WebRequest.Create(uri);<br />req.Credentials = CredentialCache.DefaultCredentials;<br />        <br />WebResponse res = req.GetResponse();

NOTE: the uri is valid.

The response is a redirect to the login page (bad credentials redirect to login page) and not the requested data provided by the web request.

I am struggling to find what I need to do in order for this request to be processed as though it was the current authenticated user.

Any advice is most appreciated.
Thanks in advance.
Ant.

Posted 28-Jul-09 23:57pm

Antony M Kancidrowski

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

Mike Ellison · Answer 1 · 2009-07-29T02:59:00

Forms Authentication works (by default) by storing an encrypted ticket as a cookie upon login, which the authentication module then reads and interprets to determine the currently logged in user.

For the situation you describe to work (if I am not misunderstanding you), the uri that forms your HttpWebRequest needs to either be in the same web application (which would be very unlikely) or it would be to a web application that is configured to use forms authentication with the same machineKey as the calling application. Configuring multiple applications with a common machineKey in web.config is one way to achieve single sign-on, allowing the user to have one login that passes through to other applications. You can read the following article, under "Web Farm Deployment Considerations" to see how:
http://msdn.microsoft.com/en-us/library/ms998288.aspx[^]
There is also a bunch of blog articles describing single signon you can find by googling "asp.net forms authentication single sign-on"

Then from the calling application it would be a matter of adding the forms authentication cookie that has already been created (again through the successful submission of a user login form) to the request object's CookieContainer[^] prior to making the call. If the target application is configured correctly, it will automatically interpret the cookie and the forms authentication credentials to determine the user.