c# - WIF to a separate domain via AJAX -


we have sites running in 2 separate domains, 1 secured api other frontend website. we want able ajax request website api using logged in users credentials.

enter image description here

to did necessary cors bits able pass our cookie api, when api tries process cookie cant decrypt it. understanding because realm doesn't match correctly.

the error when try , follows:

invalidoperationexception: id1073: cryptographicexception occurred when attempting decrypt cookie using protecteddata api (see inner exception details). if using iis 7.5, due loaduserprofile setting on application pool being set false.

if manually make same request cookie :1444 realm works correctly (so think loaduserprofile stuff red herring).

i think issue cant reuse cookie realm. if case how can perform delegation in javascript? possible without redirecting user sts cookie other realm? there better way approach javascript delegation?

useful supporting data:

the configuration of wif our api end:

    <modules runallmanagedmodulesforallrequests="true">         <add name="wsfederationauthenticationmodule" type="microsoft.identitymodel.web.wsfederationauthenticationmodule, microsoft.identitymodel, version=3.5.0.0, culture=neutral, publickeytoken=31bf3856ad364e35" precondition="managedhandler" />         <add name="sessionauthenticationmodule" type="microsoft.identitymodel.web.sessionauthenticationmodule, microsoft.identitymodel, version=3.5.0.0, culture=neutral, publickeytoken=31bf3856ad364e35" precondition="managedhandler" />     </modules>

...

<microsoft.identitymodel>     <service>         <securitytokenhandlers>             <add type="microsoft.identitymodel.tokens.sessionsecuritytokenhandler, microsoft.identitymodel, version=3.5.0.0, culture=neutral, publickeytoken=31bf3856ad364e35">                 <sessiontokenrequirement lifetime="1:00" />             </add>         </securitytokenhandlers>         <audienceuris>             <add value="http://localhost:1444/" />         </audienceuris>         <federatedauthentication>             <wsfederation passiveredirectenabled="true" issuer="http://localhost:1339/account/sign-in" realm="http://localhost:1444/" requirehttps="false" persistentcookiesonpassiveredirects="false" />             <cookiehandler requiressl="false" path="/" name="thecookiemonster" persistentsessionlifetime="60" />         </federatedauthentication>         <applicationservice>             <claimtyperequired>                 <!--this claim gets mapped user.identity.name-->                 <claimtype type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" optional="false" />                 <!--some other custom claims-->             </claimtyperequired>         </applicationservice>         <issuernameregistry type="microsoft.identitymodel.tokens.configurationbasedissuernameregistry, microsoft.identitymodel, version=3.5.0.0, culture=neutral, publickeytoken=31bf3856ad364e35">             <trustedissuers>                 <add thumbprint="a_thumbprint_key_for_our_cert" name="http://localhost:1339/" />             </trustedissuers>         </issuernameregistry>     </service> </microsoft.identitymodel>

the config of wif @ website end:

(same :1337)

    <modules runallmanagedmodulesforallrequests="true">         <add name="wsfederationauthenticationmodule" type="microsoft.identitymodel.web.wsfederationauthenticationmodule, microsoft.identitymodel, version=3.5.0.0, culture=neutral, publickeytoken=31bf3856ad364e35" precondition="managedhandler" />         <add name="sessionauthenticationmodule" type="microsoft.identitymodel.web.sessionauthenticationmodule, microsoft.identitymodel, version=3.5.0.0, culture=neutral, publickeytoken=31bf3856ad364e35" precondition="managedhandler" />     </modules>

...

<microsoft.identitymodel>     <service>         <securitytokenhandlers>             <add type="microsoft.identitymodel.tokens.sessionsecuritytokenhandler, microsoft.identitymodel, version=3.5.0.0, culture=neutral, publickeytoken=31bf3856ad364e35">                 <sessiontokenrequirement lifetime="1:00" />             </add>         </securitytokenhandlers>         <audienceuris>             <add value="http://localhost:1337/" />         </audienceuris>         <federatedauthentication>             <wsfederation passiveredirectenabled="true" issuer="http://localhost:1339/account/sign-in" realm="http://localhost:1337/" requirehttps="false" persistentcookiesonpassiveredirects="false" />             <cookiehandler requiressl="false" path="/" name="thecookiemonster" persistentsessionlifetime="60" />         </federatedauthentication>         <applicationservice>             <claimtyperequired>                 <!--this claim gets mapped user.identity.name-->                 <claimtype type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" optional="false" />                 <!--some custom claims-->             </claimtyperequired>         </applicationservice>         <issuernameregistry type="microsoft.identitymodel.tokens.configurationbasedissuernameregistry, microsoft.identitymodel, version=3.5.0.0, culture=neutral, publickeytoken=31bf3856ad364e35">             <trustedissuers>                 <add thumbprint="a_thumbprint_key_for_our_cert" name="http://localhost:1339/" />             </trustedissuers>         </issuernameregistry>     </service> </microsoft.identitymodel>

what net tab looks like:

enter image description here

i think cancelled js has detected kind of security nonsense going on.

  • machine key shared across both sites
  • both running wif 3.5

we did manage sort out upgrading wif 4.5 worked no special modifications. i'm not sure root cause in 3.5 has closed issue off me. if wants can post sample working github


Comments

Post a Comment

Popular posts from this blog

basic authentication with http post params android -

i doing basic authentication passing username , password , using basicnamevaluepair sending post params response service. my method: public stringbuilder callservicehttppost(string username, string password, string type) { // create new httpclient , post header httpclient httpclient = new defaulthttpclient(); httppost httppost = new httppost(webservice + type); httpresponse response = null; stringbuilder total = new stringbuilder(); try { url url = new url(webservice + type); /*string base64encodedcredentials = base64.encodetostring((username + ":" + password).getbytes(), base64.url_safe | base64.no_wrap);*/ string base64encodedcredentials = "basic " + base64.encodetostring( (username + ":" + password).getbytes(), base64.no_wrap); httppost.setheader("auth...
Read more

vb.net - Virtual Keyboard commands -

i wondering difference between virtual these keyboard commands is: keyeventf_extendedkey , keyeventf_keyup is. everywhere have looked gives me description based off integers , not want know each of them does. you've tagged question vb.net, these have nothing @ vb.net. they're constants defined in windows header files, use win32 api functions. as far difference, can't tell looking @ values. individual values not particularly important, that's why named identifiers used. what's important used , documentation functions tells mean. the first one, keyeventf_extendedkey , used keybdinput structure (which used along e.g. sendinput function) pass information synthesized keyboard input. if flag used, means scan code should interpreted extended key. technically, means scan code preceded prefix byte value 224 (&he0 in hexadecimal notation). the second one, keyeventf_keyup , 1 of flags available use structure. means key being released (going up)...
Read more

How to get multiresult with multicondition in Sql Server -

i need solve this. hopefully can giving me advices. for sample, i've got data : proclib.march 1 first 10 rows flight date depart orig dest miles boarded capacity ----------------------------------------------------------------- 114 01mar94 7:10 lga lax 2475 172 210 202 01mar94 10:43 lga ord 740 151 210 219 01mar94 9:31 lga lon 3442 198 250 622 01mar94 12:19 lga fra 3857 207 250 132 01mar94 15:35 lga yyz 366 115 178 271 01mar94 13:17 lga par 3635 138 250 302 01mar94 20:22 lga 229 105 180 114 02mar94 7:10 lga lax 2475 119 210 202 02mar94 10:43 lga ord 740 120 210 219 02mar94 9:31 lga lon 344...
Read more