c# - 表单授权 : Where’s my auth cookie gone?

Question

我的身份验证 cookie 去哪儿了？

当从我的 SSO 重定向到客户端应用程序时，.ASPXAUTH cookie 会丢失，但前提是这两个站点不在同一服务器上。

在 Fiddler 中，我可以看到 SSO 将 cookie 设置为响应，位于客户端应用程序的正确 cookie 路径中。然而，在重定向后，我发现请求没有携带 cookie。

登录SSO后的响应:

请求返回客户端应用程序:

登录应用 web.config 的相关部分:

<machineKey compatibilityMode="Framework20SP2"
                decryption="AES"
                decryptionKey="<a valid RSA key>"
                validation="SHA1"
                validationKey="<a valid HMACSHA256 hash>"
                />
    <!-- "SHA1" actually implements HMACSHA256, but for one reason or another, we can't specify it explicitly. -->

    <authentication mode="Forms">
      <forms loginUrl="Index"
             cookieless="UseCookies"
             requireSSL="false"
             name=".ASPXAUTH"
             path="/path/to/SSO-Virtual-Directory/"
             slidingExpiration="true"
             timeout="20"
             enableCrossAppRedirects="true"
             protection="All"
             ticketCompatibilityMode="Framework20"
             />
      <!-- set cookie path relative to virtual path of the application in IIS. See Application -> Advanced Settings to see the virtual path.   
            Cookie Paths, Domains, and Names are all CASE SENSITIVE!!!!! 
            Be sure to check the virtual path, as it doesn't update when you rename path tokens to change case. you will have to recreate the application to update the virtualpath-->
    </authentication>

    <!--SSOConfig Providers-->
    <membership defaultProvider="SqlMembershipProvider" >
      <providers>
        <clear />
        <add name="ADMembershipProvider"
             connectionStringName="ADConnectionString"
             attributeMapUsername="sAMAccountName"
             enableSearchMethods="false"
             connectionUsername="<a valid domain username"
             connectionPassword="<a valid password>"
             type="System.Web.Security.ActiveDirectoryMembershipProvider"
             />
        <!-- do not set applicationName= .-->

        <add name="SqlMembershipProvider"
             connectionStringName="SqlConnectionString"
             applicationName="SSO"
             enablePasswordRetrieval="false"
             enablePasswordReset="true"
             requiresQuestionAndAnswer="true"
             requiresUniqueEmail="true"
             passwordFormat="Hashed"
             minRequiredNonalphanumericCharacters="0"
             type="System.Web.Security.SqlMembershipProvider"
             />
        <!-- for some messed up reason applicationName is required.-->
      </providers>
    </membership>

    <roleManager defaultProvider="SqlRoleProvider"
                 enabled="true"
                 cacheRolesInCookie="true"
                 cookieName=".ASPROLES"
                 cookieTimeout="30"
                 cookiePath="/path/to/Virtual-Directory/"
                 cookieRequireSSL="false"
                 cookieSlidingExpiration="true"
                 cookieProtection="All"
                 >
      <!--set cookie path relative to virtual path of the application in IIS. See Application -> Advanced Settings to see the virtual path. eg: /secure/sso/CentralLogin/ on Exodus.  
            Cookie Paths, Domains, and Names are all CASE SENSITIVE!!!!! 
            Be sure to check the virtual path, as it doesn't update when you rename path tokens to change case. you will have to recreate the application to update the virtualpath-->
      <providers>
        <clear />
        <add name="SqlRoleProvider"
             type="System.Web.Security.SqlRoleProvider"
             connectionStringName="SqlConnectionString"
             applicationName="SSO"
             />
        <!-- set ApplicationName-->
      </providers>
    </roleManager>

客户端 Web.config:

<machineKey compatibilityMode="Framework20SP2"
                decryptionKey="<The same RSA key>"
                validation="SHA1"
                validationKey="<The same HMACSHA256 hash>"
     />

    <authentication mode="Forms" >
      <forms loginUrl="~/login/Index"
             name=".ASPXAUTH"
             path="/Payment/"
             requireSSL="false"
             slidingExpiration="true"
             timeout="20"
             cookieless="UseCookies"
             enableCrossAppRedirects="true"
             protection="All"
             ticketCompatibilityMode="Framework20"
             />
    </authentication>

    <membership defaultProvider="SqlMembershipProvider" >
      <providers>
        <clear />
        <add name="ADMembershipProvider"
             connectionStringName="ADConnectionString"
             attributeMapUsername="sAMAccountName"
             enableSearchMethods="true"
             connectionUsername="<a valid domain username"
             connectionPassword="<a valid password>"
             type="System.Web.Security.ActiveDirectoryMembershipProvider"
             />

        <add name="SqlMembershipProvider"
             connectionStringName="SqlSSOConnection"
             applicationName="SSO"
             enablePasswordRetrieval="false"
             enablePasswordReset="true"
             requiresQuestionAndAnswer="true"
             requiresUniqueEmail="true"
             passwordFormat="Hashed"
             minRequiredNonalphanumericCharacters="0"
             type="System.Web.Security.SqlMembershipProvider"
             />
      </providers>
    </membership>

    <roleManager defaultProvider="SqlRoleProvider"
                 enabled="true"
                 cacheRolesInCookie="true"
                 cookieName=".ASPROLES"
                 cookieTimeout="30"
                 cookiePath="/Payment/"
                 cookieRequireSSL="false"
                 cookieSlidingExpiration="true"
                 cookieProtection="All"
                  >
      <providers>
        <clear />
        <add name="SqlRoleProvider"
             type="System.Web.Security.SqlRoleProvider"
             connectionStringName="SqlSSOConnection"
             applicationName="SSO"
             />
      </providers>
    </roleManager>

这两个网站都是 .Net 4.5.2 上的 MVC5。

有没有人知道出了什么问题，我能做些什么？

Answer 1

因此，正如我们似乎在评论中发现的那样，问题是 SSO 和客户端驻留在不同的域\ips 上，因此浏览器不会将为 SSO 设置的 cookie 传递给客户端。有多种方法可以解决此问题，但它们需要更改您的一般 SSO 流程的工作方式。

据我了解，您只在开发环境中遇到问题，在生产环境中没有。如果是这样，假设您的 SSO 在 10.0.0.1 上，而您的客户端在 127.0.0.1 上。然后将 client.yoursite.local 域(在您的公司 DNS 中或仅在/etc/hosts 文件中)映射到 127.0.0.1 并将 yoursite.local 映射到 10.0.0.1，并使用域名而不是原始 ip 地址。然后在 SSO 中设置域为“.yoursite.local”的 cookie。然后，这应该会正确地传送到您的客户端应用程序，并且不需要对您的 SSO 流程的工作方式进行重大更改。