表奥斯:我的饼干呢？

Question

，我的饼干呢？

当从我的SSO重定向到客户端应用程序时，.ASPXAUTH cookie会丢失，但前提是两个站点不在同一台服务器上。

在Fiddler中，我可以看到SSO在客户端应用程序的正确cookie路径中将cookie设置为响应。然而，在重定向时，我发现请求不包含cookie。

登录到SSO后响应：

​

​

请求返回客户端应用程序：

​

登录应用程序的相关部分web.config：

<machineKey compatibilityMode="Framework20SP2"
                decryption="AES"
                decryptionKey="<a valid RSA key>"
                validation="SHA1"
                validationKey="<a valid HMACSHA256 hash>"
                />
    <!-- "SHA1" actually implements HMACSHA256, but for one reason or another, we can't specify it explicitly. -->

    <authentication mode="Forms">
      <forms loginUrl="Index"
             cookieless="UseCookies"
             requireSSL="false"
             name=".ASPXAUTH"
             path="/path/to/SSO-Virtual-Directory/"
             slidingExpiration="true"
             timeout="20"
             enableCrossAppRedirects="true"
             protection="All"
             ticketCompatibilityMode="Framework20"
             />
      <!-- set cookie path relative to virtual path of the application in IIS. See Application -> Advanced Settings to see the virtual path.   
            Cookie Paths, Domains, and Names are all CASE SENSITIVE!!!!! 
            Be sure to check the virtual path, as it doesn't update when you rename path tokens to change case. you will have to recreate the application to update the virtualpath-->
    </authentication>

    <!--SSOConfig Providers-->
    <membership defaultProvider="SqlMembershipProvider" >
      <providers>
        <clear />
        <add name="ADMembershipProvider"
             connectionStringName="ADConnectionString"
             attributeMapUsername="sAMAccountName"
             enableSearchMethods="false"
             connectionUsername="<a valid domain username"
             connectionPassword="<a valid password>"
             type="System.Web.Security.ActiveDirectoryMembershipProvider"
             />
        <!-- do not set applicationName= .-->

        <add name="SqlMembershipProvider"
             connectionStringName="SqlConnectionString"
             applicationName="SSO"
             enablePasswordRetrieval="false"
             enablePasswordReset="true"
             requiresQuestionAndAnswer="true"
             requiresUniqueEmail="true"
             passwordFormat="Hashed"
             minRequiredNonalphanumericCharacters="0"
             type="System.Web.Security.SqlMembershipProvider"
             />
        <!-- for some messed up reason applicationName is required.-->
      </providers>
    </membership>

    <roleManager defaultProvider="SqlRoleProvider"
                 enabled="true"
                 cacheRolesInCookie="true"
                 cookieName=".ASPROLES"
                 cookieTimeout="30"
                 cookiePath="/path/to/Virtual-Directory/"
                 cookieRequireSSL="false"
                 cookieSlidingExpiration="true"
                 cookieProtection="All"
                 >
      <!--set cookie path relative to virtual path of the application in IIS. See Application -> Advanced Settings to see the virtual path. eg: /secure/sso/CentralLogin/ on Exodus.  
            Cookie Paths, Domains, and Names are all CASE SENSITIVE!!!!! 
            Be sure to check the virtual path, as it doesn't update when you rename path tokens to change case. you will have to recreate the application to update the virtualpath-->
      <providers>
        <clear />
        <add name="SqlRoleProvider"
             type="System.Web.Security.SqlRoleProvider"
             connectionStringName="SqlConnectionString"
             applicationName="SSO"
             />
        <!-- set ApplicationName-->
      </providers>
    </roleManager>

客户端Web.config：

<machineKey compatibilityMode="Framework20SP2"
                decryptionKey="<The same RSA key>"
                validation="SHA1"
                validationKey="<The same HMACSHA256 hash>"
     />

    <authentication mode="Forms" >
      <forms loginUrl="~/login/Index"
             name=".ASPXAUTH"
             path="/Payment/"
             requireSSL="false"
             slidingExpiration="true"
             timeout="20"
             cookieless="UseCookies"
             enableCrossAppRedirects="true"
             protection="All"
             ticketCompatibilityMode="Framework20"
             />
    </authentication>

    <membership defaultProvider="SqlMembershipProvider" >
      <providers>
        <clear />
        <add name="ADMembershipProvider"
             connectionStringName="ADConnectionString"
             attributeMapUsername="sAMAccountName"
             enableSearchMethods="true"
             connectionUsername="<a valid domain username"
             connectionPassword="<a valid password>"
             type="System.Web.Security.ActiveDirectoryMembershipProvider"
             />

        <add name="SqlMembershipProvider"
             connectionStringName="SqlSSOConnection"
             applicationName="SSO"
             enablePasswordRetrieval="false"
             enablePasswordReset="true"
             requiresQuestionAndAnswer="true"
             requiresUniqueEmail="true"
             passwordFormat="Hashed"
             minRequiredNonalphanumericCharacters="0"
             type="System.Web.Security.SqlMembershipProvider"
             />
      </providers>
    </membership>

    <roleManager defaultProvider="SqlRoleProvider"
                 enabled="true"
                 cacheRolesInCookie="true"
                 cookieName=".ASPROLES"
                 cookieTimeout="30"
                 cookiePath="/Payment/"
                 cookieRequireSSL="false"
                 cookieSlidingExpiration="true"
                 cookieProtection="All"
                  >
      <providers>
        <clear />
        <add name="SqlRoleProvider"
             type="System.Web.Security.SqlRoleProvider"
             connectionStringName="SqlSSOConnection"
             applicationName="SSO"
             />
      </providers>
    </roleManager>

这两个站点都是MVC5 on .Net 4.5.2。

有没有人知道出了什么问题，我能做些什么？

Answer 1

因此，正如我们在注释中所发现的，问题在于SSO和客户端驻留在不同的域\ips上，因此为SSO设置的cookie不会通过浏览器传递给客户端。解决这个问题有不同的方法，但它们需要改变一般SSO流程的工作方式。

据我所知，您只在开发环境中有问题，而不是在生产上。如果是这样的话，假设您的SSO为10.0.0.1，客户端为127.0.0.1。然后将client.yoursite.local域(在公司DNS中或仅在/etc/host文件中)映射到127.0.0.1，将yoursite.local映射到10.0.0.1，并使用域名而不是原始ip地址。然后在SSO中设置域为".yoursite.local“的cookie。然后，这应该正确地传递到您的客户端应用程序，并且不需要对SSO流程的工作方式进行重大更改。