Pass credentials from one web site to another for seamless login

[TS]

I have a partner company that has a web site that I need to gain access
through the web site in my company. I need to be able to log into my site
and then have somekind of way to then access this other site that also
requires a login in a way that allows me to pass a set of credentials to
this other site which uses those credentials to log me in so that I don't
have to log in again. The credentials that I want to pass would be a
predetermined set of credentials based on the credentials used to login to
my site; one for read only or one for admin priveledges.

I am using windows authentication on my web site, and the other site is
using session authentication using Java and Cold Fusion. The sites are on
different networks at 2 separate companies.

I figure what I can do is pass credentials to one of their web pages that
creates a session for the browser, and authorizes this session as READ ONLY
or Admin and then will redirect to the appropriate place on their site.

Does this sound good or do I need to do something else?

If I use this approach, what are my options to pass these credentials?

thanks!

[David Coe, MCAD]

You could pass your credentials via the query string (not necessarily a good idea), or call a web service at the other site. The web service would be responsible for authentication and authorization, setting the session information, etc.

"TS" wrote:

> I have a partner company that has a web site that I need to gain access
> through the web site in my company. I need to be able to log into my site
> and then have somekind of way to then access this other site that also
> requires a login in a way that allows me to pass a set of credentials to
> this other site which uses those credentials to log me in so that I don't
> have to log in again. The credentials that I want to pass would be a
> predetermined set of credentials based on the credentials used to login to
> my site; one for read only or one for admin priveledges.
>
> I am using windows authentication on my web site, and the other site is
> using session authentication using Java and Cold Fusion. The sites are on
> different networks at 2 separate companies.
>
> I figure what I can do is pass credentials to one of their web pages that
> creates a session for the browser, and authorizes this session as READ ONLY
> or Admin and then will redirect to the appropriate place on their site.
>
> Does this sound good or do I need to do something else?
>
> If I use this approach, what are my options to pass these credentials?
>
> thanks!
>
>
>

[Joe Kaplan \(MVP - ADSI\)]

What sort of authentication mechanism does the other site provide? Does it
have a login screen or does it pop up a dialog in the brower?

If it has a login screen, then in order to create an authenticated session
with them, you are going to have to write some code (probably with
HttpWebRequest) to do a form post to their login page. If they use a
dialog, then you can probably authenticate with them using the appropriate
header values (depending on how they authenticate).

Joe K.

"TS" <manofsteele@311.com> wrote in message
news:eXjHfEgWEHA.712@TK2MSFTNGP11.phx.gbl...

> I have a partner company that has a web site that I need to gain access
> through the web site in my company. I need to be able to log into my site
> and then have somekind of way to then access this other site that also
> requires a login in a way that allows me to pass a set of credentials to
> this other site which uses those credentials to log me in so that I don't
> have to log in again. The credentials that I want to pass would be a
> predetermined set of credentials based on the credentials used to login to
> my site; one for read only or one for admin priveledges.
>
> I am using windows authentication on my web site, and the other site is
> using session authentication using Java and Cold Fusion. The sites are on
> different networks at 2 separate companies.
>
> I figure what I can do is pass credentials to one of their web pages that
> creates a session for the browser, and authorizes this session as READ

ONLY

> or Admin and then will redirect to the appropriate place on their site.
>
> Does this sound good or do I need to do something else?
>
> If I use this approach, what are my options to pass these credentials?
>
> thanks!
>
>

[[MSFT]]

Hello,

I think David's suggestion should be a good idea. Is it possible in your
solution?

Luke

[TS]

I can't do the webservice because the other site won't be able to do that. I
can of course do the query string thing, but I don't want the credentials to
be messed with.

It seems like the easiest thing would be to use the httpwebrequest as joe
pointed out, otherwise I would have to encrypt the data in q string and the
other site would have to decrypt it, et. I'm looking to have the other site
have to do as little as possible.


"[MSFT]" <lukezhan@online.microsoft.com> wrote in message
news:4hqDVjOXEHA.3788@cpmsftngxa10.phx.gbl...

> Hello,
>
> I think David's suggestion should be a good idea. Is it possible in your
> solution?
>
> Luke
>

[[MSFT]]

HttpWebRequest should be a proper solution for the issue. Here is article
you may refer:

Using Internet Request and Response Classes
[url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/htm[/url]
l/cpconusinginternetrequestresponseclasses.asp

Luke

[TS]

thanks

"[MSFT]" <lukezhan@online.microsoft.com> wrote in message
news:F4wUcLaXEHA.304@cpmsftngxa10.phx.gbl...

> HttpWebRequest should be a proper solution for the issue. Here is article
> you may refer:
>
> Using Internet Request and Response Classes
>

[url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/htm[/url]

> l/cpconusinginternetrequestresponseclasses.asp
>
> Luke
>

[Unregistered]

I am trying to pass credentials from my main site wee.ycreditrepair.com to another site I am building. How can I pass to myself? Any ideas?