Contents
Sharing authentication between two web applications
- parent app redirects the user to forms authentication screen.
- user successfully logs in.
- parent web adds an authentication cookie.
- browser attaches the same cookie from parent app.
What is app authorization?
Authorization – Where someone is given privileges within the application to access particular functions like admin, work, accounting, etc. Authentication mechanisms can be generic because they do not need to know anything about what happens inside the application. They just allow or disallow access to the application.
ASP.NET Cookie is a small bit of text that is used to store user-specific information. This information can be read by the web application whenever user visits the site. When a user requests for a web page, web server sends not just a page, but also a cookie containing the date and time.
Which is an example of authentication between multiple systems?
See the following for an example. https://www.login.mtu.edu/docs/public/mtuiso/howitworks2.html This will be mostly seemless from the user perspective. For example. User point his browser toward app A. App A does it’s authentication dance with Auth App. (requiries user to log in, etc.) User clicks a link that forwards to app B.
Can a user be authenticated through more than one platform?
User can be authenticated through the first system/platform and if the credentials are valid, some web page is sent back to the client. Once this page is loaded, client should be connected with the second system/platform transparently in the background.
How to Auth apps in the same browser?
User points his browser toward App A. App A checks for valid cookie/session/whatever. It first checks for it’s own session/cookie information. If it can’t find it’s own cookie, it looks for Auth App’s “transfer” cookie. If it’s found, then it create a new session for this app.
How are authentication tokens sent back to the client?
This token and user ID is also sent in a response back to the client and, for example, rendered on the page in hidden fields. When the page is loaded and connection with the second system/platform is taking place, token and user ID from hidden fields are retrieved and sent as parameters with connection request.