How to Synchronize Session / Security between ASP.NET and Tomcat?

Question

I have an Asp.NET 3.5 application with security/authentication. I have a second application (built using GWT and running on Windows Tomcat) running on a different machine.

I need to make the second application available to the user via a link generated from the .NET application. This part is easy, I have constructed the link in the asp.net page and the user can click on it to start working in the GWT/Tomcat session.

My question is this...

How do I set it up so that the Tomcat/GWT application is Only Accessible via the link in my asp.NET application?

I don't want the user to be able to copy the link from my asp.net page and then share that with someone else who is not authenticated within my asp.net application.

Answer 1

Your tomcat application will be passed a cookie that is the .NET authentication token iff the client has logged in to your .net application.

Your tomcat application can get this cookie from the request headers, and compose another request with this cookie to check with your .net server and see if the cookie (token) is valid.