http://forums.asp.net/t/1716734.aspx/1?Does+this+sound+secure+Two+sites+going+from+Windows+Integrated+Security+to+Forms+Fri, 09 Sep 2011 06:45:31 -040017167344580551http://forums.asp.net/p/1716734/4580551.aspx/1?Does+this+sound+secure+Two+sites+going+from+Windows+Integrated+Security+to+Forms+ <p>Two websites.&nbsp; One is a private side using windows integrated security and the other is a public side using forms authentication.&nbsp; Private side is basically for admins.&nbsp; I want to send a user from the private side to the public side.&nbsp; I was thinking of encyrpting the ad user name on the private side, then passing it as a query string to the public side.&nbsp; Then decrypt the query string and check the database to see if it is a valid user, if so create their forms ticket and they would be logged in.</p> <p>I was thinking about setting a date/time field in the databse when the user tries to get transfered then checking it on the private side and if it is over a minute don't allow the transfer.&nbsp; This would prevent someone spamming query strings to my private side page which is going to handle the transfer.&nbsp; Is this even needed?&nbsp;</p> <p></p> <p>I am using RijndaelManaged encryption.</p> 2011-09-02T15:21:47-04:004589570http://forums.asp.net/p/1716734/4589570.aspx/1?Re+Does+this+sound+secure+Two+sites+going+from+Windows+Integrated+Security+to+Forms+ <p>Hi sublime4o,</p> <p>As far as I know, it sounds OK. Please try to use it. In addition, I would suggest you to check the links below for more information about Windows Authentication and Forms Authentication.</p> <p><a href="http://msdn.microsoft.com/en-us/library/907hb5w9.aspx">http://msdn.microsoft.com/en-us/library/907hb5w9.aspx</a></p> <p><a href="http://msdn.microsoft.com/en-us/library/7t6b43z4.aspx">http://msdn.microsoft.com/en-us/library/7t6b43z4.aspx</a></p> <p>Hope&nbsp;these will help you.&nbsp;</p> 2011-09-09T06:45:31-04:00