Forms Authentication across Applications on different web servers in Asp.Net
In my previous article, I explained about Forms Authentication across multiple Applications on same web server in Asp.Net. Here we discuss about Forms Authentication across multiple Applications on different web servers in Asp.Net.
Create two web applications FormsAuthentication1, FormsAuthentication2 and host on two different servers localhost1, localhost2
If you want to share forms authentication for two web applications which are running on different web servers, add machine key for web.config file of two applications as shown below.
<system.web>
<machineKey decryption="Auto" validation="SHA1" decryptionKey="31A80D252FDA8C357F5A3EA32560769EE67D218ACE4EE523E638EE15F305940C" validationKey="FA86CEC321D16C3E197CE8B919390D5A9B5E5E64E7D73789F1420CAF28
424CF1A17291AF2BC37118158E809843C304158024A21EC67659BD70F299E1A3F336C8" />
........
</system.web>
Here you have to specify the decryptionKey and validationKey attributes values manually. You cannot allow the ASP.NET Framework to generate these keys automatically because you need to share the keys across the different web servers.
Generate decryptionKey and validationKey as shown below.
protected void Page_Load(object sender, EventArgs e)
{
Response.Write("<b>decryptionKey:</b>" + GetSequence(64) + "<br/><br/>");
Response.Write("<b>validationKey:</b>" + GetSequence(128));
}
private string GetSequence(int length)
{
byte[] buffer = new byte[length / 2];
RNGCryptoServiceProvider provider = new RNGCryptoServiceProvider();
provider.GetBytes(buffer);
StringBuilder builder = new StringBuilder(length);
for (int i = 0; i < buffer.Length; i++)
builder.Append(string.Format("{0:X2}", buffer[i]));
return builder.ToString();
}
The output displays as shown below.
Now login to FormsAuthenticationApp1 application and try to browse Default.aspx of FormsAuthenticationApp2. Great, you are able to browse the Default.aspx of FormsAuthenticationApp2 without login to the FormsAuthenticationApp2 even though this application is running on different server. Here you are maintaining the FormsAuthenticationApp1 web application authentication for FormsAuthenticationApp2 web application also.
For out comfort, we added the FormsAuthenticationApp2 web application Default.aspx url in the FormsAuthenticationApp1 web application Default.aspx and vice versa as shown below.
FormsAuthenticationApp1 Default.aspx
<form id="form1" runat="server">
<div>
Login was successful for Web Application - 1<br />
For second web application
<a href="http://localhost2:1576/FormAuthenticationApp2/Default.aspx">Click here</a>
</div>
</form>
In my system, FormAuthenticationApp2 web application Default.aspx url is http://localhost2:1576/FormAuthenticationApp2/Default.aspx.
FormsAuthenticationApp2 Default.aspx
<form id="form1" runat="server">
<div>
Login was successful for Web Application - 2<br />
For first web application
<a href="http://localhost1:1373/FormAuthenticationApp1/Default.aspx">Click here</a>
</div>
</form>
In my system, FormsAuthenticationApp1 web application Default.aspx url is http://localhost1:1373/FormAuthenticationApp1/Default.aspx.
Here I used localhost1 and localhost2 as two web servers.
