Windows和Web应用程序之间的握手

Question

We have a legacy windows application already in place. Many clients are using it. Now, we have created web application which has some additional features. I want to implement handshake between this two applications (Windows and Web) and bypass the the second time login for the user because user is already authenticated via windows application. I need logged in user details to redirect user with his/her page in web application.
My question is :: What is the secure way to do the handshake ?

Both application is implemented using .Net Framework

Answer 1

This may not directly answer your question, but it may get you on the right track (and I couldn't easily put this in a question comment).

I pass credentials between WebForms apps and use the following section in both apps' Web.Config.

<system.web>
    <!--This item defines the validation key that is shared between this 
    application and the second app (both have this exact line in order 
    to share the authentication cookie between them and prevent the
    user from having to log in more than once)

    You can generate keys here: 
    http://www.eggheadcafe.com/articles/GenerateMachineKey/GenerateMachineKey.aspx
    -->
    <machineKey validationKey="77AC2038C364CC68F1C81B8C0517DEFC7599E0C801851CB9648CF242CA1561193D11B5B034753CDBD98F3126EFDF8227B69BBD6BEC4F33DB0C9A6C9A12D40A0C" 
        decryptionKey="8ED6E18D4840AB84A95161970154E31D80A0BDD1615C6A02F1DCD9DA382BB8C2" 
        decryption="3DES"/>
</system.web>

Since we don't know how you're authenticating with either application, I can't advise on what's possible. If you're using Windows Authentication on the desktop app and the ASP.NET membership provider for the WebForms app, I'm not sure if there's a viable bridge between those two protocols.