What is the best way to implement mixed ASP.NET forms auth (AD + DB)?

Question

I want to implement forms authentication on an ASP.NET website, the site should seek the user on the database to get some data and then authenticate against LDAP (Active Directory) to validate the user/password combo.

After that I need to keep a instance of class that represents the user to use it in various forms.

I tried to do it before with a login control, that checks the previous conditions and do an AuthenticateEventArgs.Authenticated = true and placed the object inside the session: Session ["user"] = authenticatedUser; but I had problem synchronizing both of them (the session expired before the auth cookie and I got NullReferenceExceptions when the pages tried to use the now defunct session object).

Which is the best way to accomplish this? Is there some way to sync the session timeout with the cookie lifespan? The user object should be saved in any other way? Did I miss the point?

Thank you.

UPDATE: I cannot use windows auth provider because the site should be accesible from outside out priate network.

Answer 1

I would use Windows Authentication as the main authentication provider, but roll my own simple database persistence for user information.

Your session method would work, you can adjust session timeout in IIS and match it to the authentication cookie timeout.

Also, you can do something like this in a HTTPModule to catch edge cases (app pool recycles etc) that also clear session

Psuedocode:

if (session["user"] == null)
{
    Authentication.SignOut();
}

This would force the user to authenticate.

Answer 2

I set the session and auth cookie timeout values to the same value. I use sliding windows for my auth cookie. I also make it a habit to never assume that values I get out of the session are non-null before attempting to use them. I often abstract all of the session functionality out into a proxy class that contains strongly typed properties for the values I store in the session. The error handling for bad session data is localized in the proxy.

Answer 3

Storing the user info in the session will work fine. To sync session timeout and auth cookie timeout, just edit your web.config:

<sessionState timeout="XX" />
<authentication mode="Forms">
  <forms loginUrl="Login.aspx" timeout="XX" />
</authentication>

Both values are in minutes.

Test for null EVERY time you get a value from the Session!