Authenticating Users for Multiple Applications on same host name but different paths

Viewed 295

I have two mvc 5 applications setup using OWIN-MixedAuth deployed to the same server. Each application is inside a separate folder and configured with its own app pool as follows:

xyz.domain.com/MySiteA

xyz.domain.com/MySiteB

Web config for each is as follows

MySiteA:

<system.web>
   <customErrors mode="Off"/>
   <authentication mode="None" />
   <compilation debug="true" targetFramework="4.5.2" />
   <httpRuntime targetFramework="4.5.2" />
</system.web>
<!-- Enable Mixed Auth -->
<location path="MySiteA/MixedAuth">
   <system.webServer>
       <security>
        <authentication>
            <windowsAuthentication enabled="true" />
        </authentication>
       </security>
    </system.webServer>
</location>
<system.webServer>
    <modules>
        <remove name="FormsAuthentication" />
    </modules>
    <handlers>
        <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
        <remove name="OPTIONSVerbHandler" />
        <remove name="TRACEVerbHandler" />
        <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>
</system.webServer>`

MySiteB:

 <system.web>
   <customErrors mode="Off"/>
   <authentication mode="None" />
   <compilation debug="true" targetFramework="4.5.2" />
   <httpRuntime targetFramework="4.5.2" />
</system.web>
<!-- Enable Mixed Auth -->
<location path="MySiteB/MixedAuth">
   <system.webServer>
       <security>
        <authentication>
            <windowsAuthentication enabled="true" />
        </authentication>
       </security>
    </system.webServer>
</location>
<system.webServer>
    <modules>
        <remove name="FormsAuthentication" />
    </modules>
    <handlers>
        <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
        <remove name="OPTIONSVerbHandler" />
        <remove name="TRACEVerbHandler" />
        <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>
</system.webServer>`

When a user logs into one applications, the user is automatically logged into the second application as well even though they are not a registered user in the second application.

similarly loggin out of one application automatically logs the user out of the second application.

This is happening if I authenticate using a Form or windows. How can I prevent this happening?

This is my login code on both applications:

    [AllowAnonymous]
    public ActionResult Login(string returnUrl)
    {
        // If user is already logged in
        if (HttpContext.Request.IsAuthenticated)
        {
            return RedirectToAction("Index", "Manage");
        }

        ViewBag.ReturnUrl = returnUrl;
        return View();
    }

And this is what I have in startup.auth:

var cookieOptions = new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            Provider = new CookieAuthenticationProvider
            {
                // Enables the application to validate the security stamp when the user logs in.
                // This is a security feature which is used when you change a password or add an external login to your account.  
                OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                    validateInterval: TimeSpan.FromMinutes(30),
                    regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
            }
        };

        app.UseCookieAuthentication(cookieOptions);

Is there an option to change the cookie name?

1 Answers

Add CookieName to startup.auth:

 var cookieOptions = new CookieAuthenticationOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
        CookieName = "MySiteA",
        LoginPath = new PathString("/Account/Login"),
        Provider = new CookieAuthenticationProvider
        {
            // Enables the application to validate the security stamp when the user logs in.
            // This is a security feature which is used when you change a password or add an external login to your account.  
            OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                validateInterval: TimeSpan.FromMinutes(30),
                regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
        }
    };

    app.UseCookieAuthentication(cookieOptions);
Related