I have a web application (C# - ASP) that needs to pass a user to a page on a remote Apache server using HTTP Basic Authentication. I need to be able to pass a user name and password to this server to allow users authenticated by my application to seamlessly use the other application without being prompted to enter credentials he doesn't have. The hand-off should be secure since both systems require SSL as long as the user name and password are not in client-side script. Is there a way to do this?

I have a web application (C# - ASP) that needs to pass a user to a page on a remote Apache server using HTTP Basic Authentication. I need to be able to pass a user name and password to this server to allow users authenticated by my application to seamlessly use the other application without being prompted to enter credentials he doesn't have. The hand-off should be secure since both systems require SSL as long as the user name and password are not in client-side script. Is there a way to do this?

• c#
• javascript
• http
• basic-authentication

• Are both on the same server? eg could pass some random tie in string to pick up from a database to reload the session credentials into the new session on another site. – BugFinder Commented Jun 16, 2011 at 15:43
• No, they are on different servers. One (mine) is running IIS7. The other is running Tomcat7 a few thousand miles away. – Steven Scott Commented Jun 16, 2011 at 16:05
• Hmm, only thing I can think of is some form of UID which the remote server can use to call back to receive data from yours.. if you dont have any way to get them todo that, sorry, I cant think of a way round that. Hope some others have better ideas. – BugFinder Commented Jun 16, 2011 at 16:15
• Unfortunately, I do not have the ability to alter the remote server configuration or application at all. It is essentially a black box with a single door protected by HTTP Basic Auth. – Steven Scott Commented Jun 16, 2011 at 17:19

3 Answers 3

Basic authentication details are encoded in the request header named "Authorization" from the client. The header contains the base64 encoded result of "username:password".

e.g. Aladdin:open sesame = Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

There are more details on the Basic Access Auth wikipedia page.

For basic authentication, the Authorization header needs to be added to every request. Usually the browser will take care of this after the user has entered their credentials into the dialog presented by the browser. If you want to avoid having your users enter these credentials, then your ASP server will need to sit in between the user and the Apache server (acting as a reverse proxy) adding the auth headers to every request that it forwards on behalf of your users.

It is not possible to simply visit your server once and for it to add a "token" to the request then redirect to the apache server. This approach would be possible if you were using forms/cookies for authentication and your servers presented themselves to the user as within the same domain (e.g. asp.domain. & apache.domain.) then the auth cookie could be set on the parent domain (e.g. domain.) and shared - see Forms Authentication across sub-domains.

Assuming that the basic auth scheme on the Apache server is not something you can easily change, it seems like the reverse proxy is the best option. In the reverse proxy code, the HttpWebRequest is the means to create each request to the apache server and add the additional authentication headers to it.

will deal with encoding the credentials in the proxied request using something like:

RemoteServer remoteServer = new RemoteServer(httpContext);
HttpWebRequest request = remoteServer.GetRequest();
request.PreAuthenticate = true;
request.Credentials = new NetworkCredential(UserName, SecurelyStoredPassword);

Try using the url format https://username:[email protected]

Only other thing I can think of - if the page doesnt force its way out, load a page of their site in a frame, send it data+ controls, via javascript so it sends the login and so on. Might be feasible.