0

We have a third-party data visualization tool (written in Silverlight) that is hosted in IIS and provides no security or authentication at all (i.e. if you have access to the server and know the URL you can view all of the data it exposes using the credentials in the ODBC connection). We have another application we've built that does provide proper authentication and access restrictions based on the logged in user. Our current solution to "secure" the 3rd party app is to check that the user accessed it from our app. It appears we are doing that via the Referer header to check the URL.

I'm wondering if I can add a module to the pipeline that uses our existing authentication and permissions to control access to the third party application (we're currently using a mix of session and forms auth, but maybe rewriting with claims). It sounds like it should work, but does anyone have any experience with trying that sort of thing? Pitfalls? All-around bad idea?

UPDATE: I've confirmed with the vendor that it is just an ASP.Net app with a couple pages as entry points so I should be able to add forms authentication. I'm trying to get it to use a shared forms cookie, but so far no luck. I've got this in each web.config for our site (localhost/MainApp) and the vendor site (localhost/Vendor):

<authentication mode="Forms">
  <forms name=".ASPXFORMSAUTH" loginUrl="Login.aspx" protection="All" timeout="20" path="/" />
</authentication>
<machineKey
  validationKey="C50B3C89CB21F4F1422FF158A5B42D0E8DB8CB5CDA1742572A487D9401E3400267682B202B746511891C1BAF47F8D25C07F6C39A104696DB51F17C529AD3CABE"
  decryptionKey="8A9BE8FD67AF6979E7D20198CFEA50DD3D3799C77AF2B72F"
  validation="SHA1"/>

For the record, those are not the keys I will be using in production, but are instead taken from an MSDN sample.

I've updated the vendor's global.asax file (we're already doing that in our installer) to add:

protected void FormsAuthentication_OnAuthenticate(object sender, FormsAuthenticationEventArgs args)
{
    System.Diagnostics.Debug.WriteLine("FormsAuthentication_OnAuthenticate");
    if (Request.Cookies[FormsAuthentication.FormsCookieName] != null)
    {
        System.Diagnostics.Debugger.Break();
        try
        {
            FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(Request.Cookies[FormsAuthentication.FormsCookieName].Value);
            args.User = new System.Security.Principal.GenericPrincipal(new FormsIdentity(ticket), new string[0]);

            if (!args.User.Identity.IsAuthenticated)
            {
                Context.Response.Redirect("~/Error.htm");
            }
        }
        catch (Exception e)
        {
            Context.Response.Redirect("~/Error.htm?" + e.Message);
            // Decrypt method failed.
        }
    }
    else
    {
        Context.Response.Redirect("~/Error.htm?CookieNotFound");
    }    
}

but now I'm just getting "Unable to validate data." After removing the domain from the forms tag, authentication is now working. I just need to remove it from the service calls and I'll be all set (yes, that does open up the services to the world, or at least the everyone that has access to the intranet).

2 Answers 2

1

So you have a .xap file? You want to protect it with forms authentication, is that correct? I would recommend simply adding a handler mapping for .xap extensions in IIS and map it to ASP.NET. You can take it a step further and create an intermediate page or handler that actually streams the .xap file. This way - it will be protected by forms authentication. Here are some discussions (they use flash SWF files but the concept is the same):

How to secure access to SWF file using ASP.NET?

http://www.justskins.com/forums/file-types-not-protected-157682.html

Does your silverlight application call web services that you host also? You'll probably want to ensure those are secured as well.

EDIT: I also just noted you have them set up as two separate applications -- if the .NET frameworks are similar between the 2, you should experiment with setting up your silverlight-based application as a child application underneath your ASP.NET application. The forms authentication settings should be inherited that way..

4
  • If only it were that simple. It's a purchased application, and it appears to be a complete ASP.Net application that serves up SilverLight apps. I need to secure the entire app and the installer puts it in a fixed location that we can't control or change. Feb 20, 2013 at 19:02
  • You can't set up a new (child) web application and point it to the same physical path? You can set it to run in the same application pool as the original, I bet with a bit of tweaking you may be able to get it going.
    – mikey
    Feb 20, 2013 at 19:10
  • Didn't think of that :) I'll give it a try and see what happens. Feb 20, 2013 at 19:18
  • If you can set it up first as a new web application (not a child of yours) then you'll know the potential issues involved with doing that. Then try and set it up and a child of your ASP.NET application and you'll likely need to address any web.config inheritance related issues that arise by applying <clear/> tags to the right places ;)
    – mikey
    Feb 20, 2013 at 19:21
0

Silverlight needs to be hosted in a html file (browser based) - ok it puts it in a location, but you can use a redirect to that location, which it only accessable by a forms authenticated page.

You can add the requirement of login cookie to the html/aspx page that serves the silverlight app.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.