在同一服务器上使用多个Web服务进行表单身份验证

Question

I have four c# 4.5 MVC RESTful web services running on one server under IIS 7.5 which I can access like this...

http://1.2.3.4:5/Service1/Controller/Method
http://1.2.3.4:5/Service2/Controller/Method
http://1.2.3.4:5/Service3/Controller/Method
http://1.2.3.4:5/Service4/Controller/Method

One of the Service1 methods available acts as a logon and returns a Forms Authentication cookie using...

FormsAuthentication.SetAuthCookie(user.UserName, false);

This seems to work fine and I can only access the Service1 methods which have been protected using the [Authorize] attribute if the login method has been called with appropriate parameters.

What I can't understand is why I cannot invoke any of the Service2/3/4 methods which have the [Authorize] attribute set - all the services are on the same server using the same IP and port, are they still deemed to be different services and not able to use the same cookie?

The path in the cookie returned by the login is "/" but I'm guessing that that is simply relative to the root of the service and therefore "/" for Service1 is not the same as "/" for Service2/3/4.

If this is the case, how can I permit them all to share the cookie? I can't see any way to make IIS "share" a common root for the four of them.

I tried setting the following in the web.config in all four services...

<forms enableCrossAppRedirects="true" domain="1.2.3.4" protection="All" path="/"/>

...but it didn't seem to help, again I assume the "/" doesn't map across the applications.

I've looked at quite a few topics relating to this but the trouble is that I'm not sure exactly where the problem lies so I'm not exactly sure what to search for - none of the Forms Authentication posts and topics I've looked at deal with exactly this problem or the solutions they include don't seem to work for me.

Any pointers would be gratefully accepted.

Answer 1

Finally found something which pointed me to a solution, albeit via a round-about route.

I discovered that I need to set the machineKey to the same value across the four web services ie add...

<machineKey validationKey="5B23............................944D"
            decryptionKey="E008.......686E"
    validation="SHA1"/>

...to the system.web section of all the web.config files. I had seen stuff about this but discounted it because I had no Machine Key entry in the Features View in IIS.

Seems it might have been a little easier to discover this, were it not for the fact that my IIS does not show the Machine Key entry for some bizarre reason - but that's another problem for another day. Once I had realised this was an issue and grabbed a code snippet to generate the keys, I was in business.