ASP.NET Authentication and Provider...

Question

I am trying to navigate from one website on my localhost to second website on my localhost.

Both sites have their own membership provider. I'm trying to use a FormsAuthorizationTicket from site #1 to SSO a user into site #2.

Currently I'm getting this error: System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed

Steps I have taken up to this point include: Setting the element to specific key values Set the machineKey attributes of validation and encryption to "3DES" Verified through logging that the encrypted ticket has the same value in the #2 website as it was given in the #1 website.

---

My code is here:

  *FormsAuthentication.Initialize();
  FormsAuthenticationTicket newTicket = new 
   FormsAuthenticationTicket(1 // Ticket Version
   , Login1.UserName      // User Name
   , DateTime.Now       // Creation Date
   , DateTime.Now.AddDays(1) // Expiration Date
   , true            // Is Persistant
   , Login1.UserName);     // This should be a list of Roles


  string strEncyptedTicket = FormsAuthentication.Encrypt(newTicket);
  HttpCookie myCookie = new HttpCookie("cryptCookie", strEncyptedTicket);
  myCookie.Values.Add("username", Login1.UserName);
  myCookie.Values.Add("cryptTick", strEncyptedTicket);
  Response.Cookies.Add(myCookie);*

---

In website #2 I created a landing page to verify the ticket and redirect to a members only page. During decryption is when I get the error specified above.

Here is my landing page code on website #2:

---

  *FormsAuthenticationTicket fat2 = FormsAuthentication.Decrypt(Request.Cookies["cryptCookie"].Values["cryptTick"]);


  MembershipUser mu = Membership.GetUser(Request.Cookies["cryptCookie"].Values["username"]);
  if (mu == null)
  {
   lblInfo.Text += "member not found";
   return;
  }

  Response.Redirect(@"~\MemberPages\MemberPage.aspx");*

If anyone has an idea to help I'll be happy to try.

Answer 1

Both sites need to share the same machine key.

Answer 2

Ian is correct in that your sites need to have a matching machine key. Also, you need to make sure that your membership providers have the same setting, particularly concerning password encryption.

Also, why are you handling this completely in code? You should be able to configure this functionality withing the Web.Config of both sites very easily. In essence, you are doing a lot of rework and introducing potential problem areas where it is not necessary (unless you have reason that you have not stated here).