How to skip authentication for certain user agentes on IIS7?

Question

Hello!

I'm writting a software in C# and .NET to manage my store, which has a site where you can go and opt in to receive a sellers person visit. This site has an behind the scenes manager, but I want the software to do this instead, effectively removing the browser manager and the first step towards this goal is to allow the software access to a PHP script that generates tha XML file required.

The problem is, the login mechanics, written in C# and using web.config, doesn't allow the software to access the said script, which is inside a protected folder for the browser manager. I already tried using HttpWebRequest object, WebClient object with lots os combinations of post, credentials, streams and even a special user-agent to try and login, without success, I can only download the login page.

Here's the code I'm using to download data at the moment (That's my latest try, using the special header):

string agent = "AGENT"; //Not real name, it's just confidential
WebClient client = new WebClient();
client.Headers["HTTP_USER_AGENT"] = agent;
client.DownloadFileCompleted += new AsyncCompletedEventHandler(DownloadFileCompletedEvtHdl);
client.DownloadProgressChanged += new DownloadProgressChangedEventHandler(DownloadProgressChangedEvtHdl);
if (!Directory.Exists(toSavePath))
{
   Directory.CreateDirectory(toSavePath);
}
 if (File.Exists(toSavePath + filename))
{
   File.Delete(toSavePath + filename);
}
client.DownloadFileAsync(new Uri(url), toSavePath + filename);

The login page is pretty simple, it only assings a click event to the login button to check if the user and password are the same in web.config. If true, got to redirect page, else, error.

So, what's the best method for this? Is there any way to configure IIS7 to skip the authentication on that special user agent or some other custom header? Or I'm going the wrong way?

Thanks in advance!

Answer 1

What you want to do is write a HttpModule (or use the global.asax) to hook into the AuthorizeRequest event.

At this stage you can verify whatever allows your user to bypass logging in and you can then set

context.SkipAuthorization = true

http://csharpdotnetfreak.blogspot.com/2009/04/aspnet-bypass-forms-authentication.html