sharing asp.net 4 forms authentication cookie with asp.net core 2.0

Question

We have multiple applications setup in IIS with one application handling the login for all applications. This application is an asp.net 4 site and uses a forms authentication cookie.

<authentication mode="Forms">
  <forms loginUrl="~/Account/LogOn" protection="All" cookieless="UseCookies" path="/" name="CookieName" />
</authentication>

We can successfully use this cookie to login to asp.net 4.5 apps using owin.

app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            TicketDataFormat = new SharedTicketDataFormat(),
            CookieName = "CookieName",
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            Provider = new CookieAuthenticationProvider
            {
                OnValidateIdentity =
                    SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                        validateInterval: TimeSpan.FromMinutes(30),
                        regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
            }
        });


public class SharedTicketDataFormat : ISecureDataFormat<AuthenticationTicket>
{
    public string Protect(AuthenticationTicket data)
    {
        return FormsAuthentication.Encrypt(new FormsAuthenticationTicket(data.Identity.Name, false, -1));
    }
    public AuthenticationTicket Unprotect(string protectedText)
    {
        var ticket = FormsAuthentication.Decrypt(protectedText);
        var identity = new FormsIdentity(ticket);
        return new AuthenticationTicket(identity, new AuthenticationProperties());
    }
}

In asp.net core 2.0 I do not know to to wire up the app to use the shared cookie

In Startup.cs Configure

app.UseAuthentication();

ConfigureServices

services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        })
        .AddCookie(options =>
        {
            options.Cookie.Name = "CookieName";
        });

Hi, Did you able to solve this? I am also looking for similar solution. — SamJackSon
– SamJackSon, Commented Jan 22, 2018 at 2:28
@SamJackSon No unfortunately not, due to time pressures we went back to asp.net 4.6. — skyfoot
– skyfoot, Commented Jan 22, 2018 at 9:06
Thanks for the reply @skyfoot. I attempted using this solution & initial results are good, seems to be working. Playing more with AuthorizationHandler. github.com/dazinator/AspNetCore.LegacyAuthCookieCompat — SamJackSon
– SamJackSon, Commented Jan 23, 2018 at 2:05

ssmith · Accepted Answer · 2020-02-12 21:01:17Z

1

My understanding is that you need to change from relying on machine key for your cookie encryption and switch over to use a DataProtectionProvider. This article in the docs spells out everything very clearly:

https://learn.microsoft.com/en-us/aspnet/core/security/cookie-sharing?view=aspnetcore-3.1#share-authentication-cookies-with-aspnet-core-identity

answered Feb 12, 2020 at 21:01

ssmith

9,0328 gold badges61 silver badges97 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

sharing asp.net 4 forms authentication cookie with asp.net core 2.0

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related