After much work (and learning!) I got it to work with HttpWebRequest (& -Response) as you suggested!
Here is my final code (for anyone else learning this) that worked for me, as compared to what I posted above:
void Page_Load(Object Src, EventArgs E) {
string VENDORauthenticated = (Session["bolAuthenticated"]).ToString();
if (VENDORauthenticated != "True")
{
Response.Redirect("http://www.myurl.org/Authentication.aspx?" + Request.ServerVariables["SCRIPT_NAME"]);
}
else
{
//Authenticate to VENDOR via ASP.NET
//6/17/2009
//Utilizes HttpWebRequest & HttpWebResponse
//Make this page require authentication to access
//Remove the authorization for subsequent attempts to access during the same session in case the browser is left open
Session.Abandon();
//##Set Basic variables
string sHTML;
string sVENDORHost;
string sPath;
string sUserName;
int jStatus;
string sStatus;
sVENDORHost = "logon.VENDOR.org";
sUserName = Request.UserHostAddress;
sPath = "/";
//##Generate the URL to VENDOR
//#Note that the pieces of this URL will be specific to your own application; I only slightly changed it here from my real one as a hopefully better example...
string sReqString = "http://" + sVENDORHost + "/logon/remote" + sPath + "?cred=" + "user(" + sUserName + ")";
//##Create the HttpWebRequest Object
HttpWebRequest VENDORrequest = (HttpWebRequest)WebRequest.Create(sReqString);
//##Set HttpWebRequest User Agent info
VENDORrequest.UserAgent = "VENDORremote " + Request.ServerVariables["HTTP_USER_AGENT"];
//##Turn HttpWebRequest Redirects off--this should depend on your own situation, but since in this case our VENDOR is going to send us the new URL we requested anyway, we don't need to be redirected by them
VENDORrequest.AllowAutoRedirect = false;
//##Create the HttpWebResponse Object
HttpWebResponse VENDORresp = (HttpWebResponse)VENDORrequest.GetResponse();
//## Put the Response status into a variable for later use
jStatus = (int)VENDORresp.StatusCode;
sStatus = jStatus.ToString();
//## Put the Response Text into a variable
sHTML = VENDORresp.StatusDescription;
//## Check the Response Status Code
if (sStatus == "302")
{ //##Redirect from VENDOR was sent, so put the Location Response Header into a variable
string sLocation = VENDORresp.GetResponseHeader("Location");
//## Kill the HttpWebRequest and HttpWebResponse objects
VENDORrequest = null;
VENDORresp = null;
//## Redirect the client
Response.Redirect(sLocation);
}
else
{
//## Kill the HttpWebRequest and HttpWebResponse objects
VENDORrequest = null;
VENDORresp = null;
//## Replace local paths with VENDOR Paths
sHTML = sHTML.Replace("src=\"", "src=\"http://" + sVENDORHost);
sHTML = sHTML.Replace("href=\"", "href=\"http://" + sVENDORHost);
//## Output whatever is returned
Label1.Text = "An error has occurred: " + sHTML;
}
}
Session.Abandon();
The "bolAuthenticated" is a session variable I set in my Global.asax file, as so:
void Session_Start(object sender, EventArgs e)
{
// Code that runs when a new session is started
Session["bolAuthenticated"] = false;
}
On the initial login page, "bolAuthenticated" is checked to see if it has been set to "True" or not. If so, then the rest of the page script proceeds. If not, then the use is forwarded to an authentication page where the user has to type in a password, which (if valid) will set the bolAuthenticated session variable to "true" and forward the user back to the login page, allowing the rest of the login script to proceed. The initial login page URL is persisted onto the authentication page so the user can be redirected back again (and the authentication page can therefore be used for any number of login pages). All as per the script as seen up above:
string VENDORauthenticated = (Session["bolAuthenticated"]).ToString();
if (VENDORauthenticated != "True")
{
Response.Redirect("http://www.myurl.org/Authentication.aspx?" + Request.ServerVariables["SCRIPT_NAME"]);
It's also important to use the "Abandon.Session" command at various points on both pages to make sure that the "bolAuthentication" variable gets set back to false, so that other people can't scroll back through the open browser and get access without entering their own password.
Anyway, the HttpWebRequest and HttpWebResponse really made this work for me with my migration.
Thanks again!
-_Will