Posted by Community Admin on 23-May-2011 00:00

Hi,

I've been holding off on upgrading to 4 from 3.7 because currently we have windows authentication enabled and 4.0 didn't support this.

I noticed with 4.1 you know allow auto login with windows authentication if you have AD enabled:
www.sitefinity.com/.../enabling-windows-authentication.aspx

While I didn't really want to turn on AD authentication I'm happy to do so if it works. My main problem is going to be: Does Sitefinities LDAP support searching/authenticating accross the root and Child domains and if so how would I do this.

We have about 6 or 7 active domains on our network.

Thank you for any help you can provide.

Regards
Byron

Posted by Community Admin on 23-May-2011 00:00

Hi Byzza,

If you mean Single Sign On, by authenticating over several domains, this is still not supported out of the box. It could be done with a custom implementation on subdomains, because this will allow you to easily pass the cookies from the cookie collection. There is a method of the SecurityManager that you can use - AuthenticateUser. AuthenticateUser validates the user - password and username - password is encrypted and compared with the input you use. Then the username and passwordare compared. If the user is valid we get the user , verify the ip and last login request SetAuthenticationCookie was made internal, so to authenticate a user you should use AuthenticateUser method. Basically we create the cookie with the cookie path, domain and whether ssl is required. Then we add the cookie to the FormsAuthenticationTicket, decrypt it and set Expires property of the cookie. To decrypt the password we use the decryptionKey inside App_Data/Sitefinity/Configurations/SecurityConfig.config

<securityConfig authCookieName=".SFAUTH-/" rolesCookieName=".SFROLES-/" validationKey="279EB02E02B8322864837AA092A6384F61E267310BD526CA5AA7BA61B7ECA17071022B3F025FBA05CB390ECE4CF2B7D93F377CD50085355795AF69C89AA347C2" decryptionKey="DF845BFCA7B2A84D0649DA8F2C033715772EA183D8A1A2E7072082CD0482DBDE" loggingCookieName=".SFLOG-/">

Here is a sample code that should authenticate a user from one application to another. Note that this will work only if you are on the same domain name, because the cookies are not valid between different domains. If you are going to use different domains you should have a common repository where you should save the cookies. You should also add another parameter to the request - some ID that will take care of the expiration of this cookie for the current request, so that this will not allow to others to use it.

using System;

using System.Collections.Generic;

using System.Linq;

using System.Web;

using System.Web.UI;

using System.Web.UI.WebControls;

using System.Net;

using System.IO;

using System.Text;

public partial class Default8 : System.Web.UI.Page

protected void Page_Load(object sender, EventArgs e)

var membershipProvider = "";

var userName = "admin";

var password = "admin@2";

var rememberMe = true;

if (AuthenticateRequest(membershipProvider, userName, password, rememberMe))

Response.Redirect("http://localhost:4000/Sitefinity/Pages");

else

Response.Write("Try Again.");

public string InvokeWebMethod(string serviceUrl, string methodName, string httpMethod, byte[] data)

var request = (HttpWebRequest)WebRequest.Create(String.Concat(sitefinityHost, serviceUrl, methodName));

request.Method = httpMethod;

request.ContentType = "application/json";

request.CookieContainer = new CookieContainer();

if (cookies != null)

foreach (Cookie cookie in cookies)

if (!cookie.Expired)

request.CookieContainer.Add(cookie);

if (data != null)

request.ContentLength = data.Length;

using (var writer = request.GetRequestStream())

writer.Write(data, 0, data.Length);

using (var response = (HttpWebResponse)request.GetResponse())

// HERE WE GET THE RESPONSE AND ADD THE COOKIES TO IT.

cookies = response.Cookies;

using (var reader = new StreamReader(response.GetResponseStream(), Encoding.UTF8))

// GET THE cookies AND ADD COOKIES NAME AND VALUE TO THE CURRENT RESPONSE!

var name = "";

var value = "";

Response.Cookies.Add(new HttpCookie(name, value));

return reader.ReadToEnd();

public bool Logout()

return InvokeWebMethod(usersServiceUrl, logoutCurrentUserMethod, "GET", null) == "true";

public bool Logout(byte[] credentials)

return InvokeWebMethod(usersServiceUrl, logoutUserWithCredentialsMethod, "POST", credentials) == "true";

private bool AuthenticateRequest(string membershipProvider, string userName, string password, bool rememberMe)

var jsonData = String.Format(credentialsFormat, membershipProvider, userName, password, rememberMe.ToString().ToLower());

var credentials = Encoding.UTF8.GetBytes(jsonData);

string result = InvokeWebMethod(usersServiceUrl, authenticateMethod, "POST", credentials);

switch (result)

case "0":

return true;

case "3":

case "6":

case "9":

Response.Write(

"There is a user with the same credentials logged in the system form another application or browser.\r\n It will be logged out"

);

if (Logout(credentials))

return InvokeWebMethod(usersServiceUrl, authenticateMethod, "POST", credentials) == "0";

return false;

default:

return false;

private const string credentialsFormat = @"

""MembershipProvider"":""0"",

""UserName"":""1"",

""Password"":""2"",

""Persistent"":3

";

private static CookieCollection cookies;

private const string usersServiceUrl = "/Sitefinity/Services/Security/Users.svc/";

private const string authenticateMethod = "Authenticate";

private const string logoutCurrentUserMethod = "Logout";

private const string logoutUserWithCredentialsMethod = "LogoutCredentials";

private const string logoutOtherUserMethos = "Logout/0/1";

private const string sitefinityHost = "http://localhost:4000";

Greetings,
Ivan Dimitrov
the Telerik team

Do you want to have your say in the Sitefinity development roadmap? Do you want to know when a feature you requested is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items

Posted by Community Admin on 24-May-2011 00:00

Hi,
Thank you for such a quick response.

I don't think that is actually what I'm after. Please correct me if I'm wrong but what you have there is to allow a user to be authenticated on:
http://domain1.mycompany.com
http://domain2.mycompany.com
http://domain3.mycompany.com
so if they log into one they log into all 3 so they don't have to log in again?

If so, not that is not what I'm after.

We have an intranet here (eg http://intranet/) which is avalible from all our sites around the world via VPN. Each of the Major sites have their own Active directory Server, and such their own Domain. So a user at head office would log in with the username "HeadOffice\user1" where as a user at another site might log in with the username "Site123\user2"

The HeadOffice domain is the master/primary domain and all the other domains are linked into it so that they all work together and can see each other.

Now I think I worked out in theroy I could create a whole heap of membership providers, one for each domain and the user just selects the domain they need to sign in to, BUT because I'm trying to avoid the whole sign in all together and use Windows Authentication I assume I must have only one LDAP membership provider active.

So could you please let me know if Sitefinity would be able to support this setup with Windows authentication and how I can set it up.

--------------------------------------
On another note though, just to try and see how the LDAP worked (this is the first Time I've ever used LDAP) I decided to try and set it up with just HeadOffice, just to see if it would work if it could even connect, and so far nothing I try will work. I've spoken to our network admin, and I've used a program called "LDAP Browser" to mimic the settings in Sitefinity, but no matter what settings I try when I go to users none are returned from AD.

I've attached a screen shot of the final Config I tried.
the port I have set in the screen shot is to a Global list which should have all the domains together according to the network admin (just experimenting with both), but I've tried the normal port as well just for Head office.

If you could please help on either issue that would be great.

Thank you
Byron Boardman

Posted by Community Admin on 24-May-2011 00:00

Ok, so i'm still having the mulitple domain issue still (well haven't started too look into it yet), but as far as the second issue goes I finally got SF connected to LDAP and under user accounts I can see the full list under our main domain, but when I follow the instructions here:
http://www.sitefinity.com/documentation/installation-and-administration-guide/system-settings/enabling-windows-authentication.aspx

And change the web.config from

<authentication mode="Forms"/>

to

<authentication mode="Windows"/>

I'm now getting this error:

Server Error in '/SPTest' Application.

Invalid full name format.
Parameter name: windowsIdentity.Name

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.ArgumentException: Invalid full name format.
Parameter name: windowsIdentity.Name

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:


            [ArgumentException: Invalid full name format.
Parameter name: windowsIdentity.Name]
   Telerik.Sitefinity.Security.WindowsIdentity.LoadUser(WindowsIdentity windowsIdentity) +404
   Telerik.Sitefinity.Security.WindowsIdentity..ctor(WindowsIdentity windowsIdentity) +26
   Telerik.Sitefinity.Security.SecurityManager.BuildIdentity(HttpContextBase context) +697
   Telerik.Sitefinity.Security.SecurityManager.BuildPrincipal(HttpContextBase context) +103
   Telerik.Sitefinity.Security.SecurityManager.AuthenticateRequest(HttpContextBase context) +380
   Telerik.Sitefinity.Web.SitefinityHttpModule.Context_AuthenticateRequest(Object sender, EventArgs e) +18
   System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +148
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.1

I can't seem to get around this no matter what I try.

Posted by Community Admin on 25-May-2011 00:00

Byzza -

I am seeing similar error messages after following the instructions listed in that link - but only for a few users so far - others are fine.

So I ask...

What can we look at to see why certain users are getting the above message?

Also - what happens when a user can't be authenticated automatically? It seems as though they go to my defined login page - is this correct? ---- EDIT: This was because I still had some Authentication-related code in my .MASTER page for generating some Session variables