How can I forms authenticate a user in a custom webservice?

Question

I am working on integrating a silverlight site into our existing application and am trying to get the login functionality working. The Silverlight application needs to have it's own login page, and the login needs to utilize the existing ASP.NET forms authentication. As part of the login procedure, we are calling some external code, so using the scriptable methods that System.Web.ApplicationServices.AuthenticationService exposes is not an option. I tried to use FormsAuthentication.Authenticate to do this, but it didn't work. Does anyone have any ideas on how to get around this?

Answer 1

It sounds as though you need to create a wrapper websevice which can implement the forms authentication support.

This is something I've done so for example I've created a WCF service with the following interface which is referenced by my Silverlight client:

[ServiceContract]
    public interface IAuthenticationService
    {
        [OperationContract()]
        string Login(string username, string password, bool isPersistent);
        [OperationContract()]
        bool Logout();
        [OperationContract()]
        string IsLoggedIn();     
    }

and then in my implementation you can call custom code and also use the forms authentication api, for example to login you could have:

try
            {
                //Call you external code here
                //Then use the membership provider to authenticate
                if (Membership.ValidateUser(username, password))
                {

                    FormsAuthentication.SetAuthCookie(username, isPersistent);

                }
            }
            catch (Exception ex)
            {
                Logging.LogException("Error in Login", ex);
            }

Also not you need to include the following attribute above you class definition in your service implementation to have asp.net compat enabled which will give you access to the HttpContext:

 [AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]

Answer 2

The solution is simple. Just create a custom membership provider that calls your custom code. See this article on MSDN library for more information. There are also full samples available on 15 seconds and a walkthrough video on the ASP.NET website. Finally, it appears Microsoft has released the source for the built-in Membership Provider