How to bypass forced login for a token authenticating service?

Question

OK so whenever anyone hits our site who is not logged in, it pushes to the login page and has them sign in, and then pushes them back to the page they attempted to access. I have been tasked to create a service (using ASHX) that returns reporting data via xml. This is all done, however in order to access it you have to be logged in. Instead of logging in I am going to have them pass a token through query string to authenticate that it is a valid request. However I am unsure how to go about bypassing the forced login. Is this too vague or does anyone have any ideas? I suppose the last ditch effort would be to create a totally separate site in ISS but I would like to avoid that if possible.

Answer 1

One way to do it in the same site would be to have your service accessible anonymously, then do your own authentication inside the service against the token.

Edit:

To allow anonymous, add a section to your web.config that allows full access to a directory that contains your service. For example, your service is http://www.foo.com/Services/bar.asmx.. Add this to your web.config where your other authorization sections are:

<location path="Services">
    <system.web>
        <authorization>
            <allow users="*" />
        </authorization>
    </system.web>
</location>

Then, in your service, authenticate your token you've passed in however you want to. If the authentication doesn't pass, throw a SoapException. How to authenticate all depends on how you are currently authenticating in your login page..

Hope this helps.

Answer 2

Just change your sign in page to check the referrer or URL for your details.

If it finds it, automatically make it authenticate this user you have setup.

Eg.

// In your signin aspx file
bool bYourCriteriaIsMet = true; // do something here like check the referrer or querystring etc..";
if (bYourCriteriaIsMet)
{
    FormsAuthentication.RedirectFromLoginPage("Your Temp User Name", false);
}

Just figure out what you need to verify and then do the redirect manually.

You could also just have the page you want accessible in the NON secured area like where your sign in page exists then anyone will be able to access it without having to worry about all this redirect and authentication stuff.