asp.net单点登录
单点登录:A B C三个网站登录其中任何一个网站,其他网站就无需登录。
我的实现思路:
使用cookie,因为cookie是存在客户端的,A B C三个网站都可以对它进行存取。
架构如下:
AddCookie:保存Cookie
LoginOutGo:删除 Cookie
defualt:首页
login:登录页
loginOut:注销
wegconfig配置如下:
<appSettings> <!--帐号密码--> <add key="acc" value="51aspx"/> <add key="pas" value="51aspx"/> <!--服务端凭证过期时间(分钟)--> <add key="timeout" value="30"/> <add key="SignSite" value="http://localhost:49840/Public/AddCookie.aspx;http://localhost:50043/Public/AddCookie.aspx;http://localhost:50274/Public/AddCookie.aspx;"/> <add key="SignSiteOut" value="http://localhost:49840/Public/LoginOutGo.aspx;http://localhost:50043/Public/LoginOutGo.aspx;http://localhost:50274/Public/LoginOutGo.aspx;"/> </appSettings>
<authentication mode="Forms"> <forms loginUrl="/Login.aspx" name=".WebSite" protection="All" slidingExpiration="true" timeout="4320" path="/" defaultUrl="/default.aspx"></forms> </authentication>
登录过程:
输入帐号和密码:都是51aspx
点击提交按钮,提交按钮点击事件被触发:
protected void btnSubmit_Click(object sender, EventArgs e) { Uri baseUri = new Uri(Request.Url.AbsoluteUri.ToString()); Uri absoluteUri = new Uri(baseUri, "/default.aspx"); //Response.Write(absoluteUri.ToString()); string fromurl = new Uri(baseUri,FormsAuthentication.DefaultUrl).ToString(); //起始 URL 路径 if (string.IsNullOrEmpty(fromurl)) fromurl = absoluteUri.ToString(); string next = allLoginUrl; //摸拟用户登录验证(帐号、密码于web.config中) //真实环境此处应通过数据库进行验证 if (this.txtAccount.Text == System.Configuration.ConfigurationManager.AppSettings["acc"] && this.txtPassport.Text == System.Configuration.ConfigurationManager.AppSettings["pas"]) { FormsAuthenticationTicket tk = new FormsAuthenticationTicket(1, this.txtAccount.Text, System.DateTime.Now, DateTime.Now.AddMinutes(double.Parse(System.Configuration.ConfigurationManager.AppSettings["timeout"])), false, "测试用户数据"); string key = FormsAuthentication.Encrypt(tk); //得到加密后的身份验证票字串 string url = next.Split(';')[0]; //从 URL 中拆分出将要跳转的下一张页面 next = next.Replace(url + ";", ""); //带入下一轮跳转的字串 //Response.Redirect(from); Response.Redirect(url + "?CookieTicket=" + key + "&FromUrl=" + fromurl + "&NextUrl=" + next); //跳至下一页面 ////产生令牌 //string tokenValue = this.getGuidString(); //HttpCookie tokenCookie = new HttpCookie("Token"); //tokenCookie.Values.Add("Value", tokenValue); ////tokenCookie.Domain = "passport.com"; //Response.AppendCookie(tokenCookie); ////产生主站凭证 //object info = true; ////CacheManager.TokenInsert(tokenValue, info, DateTime.Now.AddMinutes(double.Parse(System.Configuration.ConfigurationManager.AppSettings["timeout"]))); ////跳转回分站 //if (Request.QueryString["BackURL"] != null) // Response.Redirect(Server.UrlDecode(Request.QueryString["BackURL"])); } else { Response.Write("抱歉,帐号或密码有误!请在Web.config中配置帐号密码!"); } }
跳转链接URL为:http://localhost:49840/Public/AddCookie.aspx,参数略,AddCookie的Page_Load事件被触发。
public partial class AddCookie : System.Web.UI.Page { protected void Page_Load(object sender, EventArgs e) { string from = Request["FromUrl"]; //起始 URL 路径 string next = Request["NextUrl"]; //还需要跳转的 URL string key = Request["CookieTicket"]; //已加密的 Cookie 文本 if(string.IsNullOrEmpty(from)) Response.Redirect(FormsAuthentication.DefaultUrl); if (key != null && key != "") { System.Web.HttpCookie ck = new HttpCookie(FormsAuthentication.FormsCookieName, key); ck.Path = FormsAuthentication.FormsCookiePath; ck.Expires = System.DateTime.Now.AddYears(10); Response.Cookies.Add(ck); //将传过来的已加密的身份验证票添加至客房端 Session["UserName"] = FormsAuthentication.Decrypt(ck.Value.ToString()).Name; string url = next.Split(';')[0]; //从 URL 中拆分出将要跳转的下一张页面 next = next.Replace(url + ";", ""); //带入下一轮跳转的字串 if (url != "") { Response.Redirect(url+"?CookieTicket="+key+"&FromUrl="+from+"&NextUrl="+next); } else //已没有下一页面可供跳转 { Response.Redirect(from); //回到起始页面 } } } }
跳转链接URL为:http://localhost:50043/Public/AddCookie.aspx
就这样跳转到第三个网站的AddCookie,当url为空时,参数略,跳到原始,即第一个站点的default页。
注销过程:
直接清除cookie.
关于:AuthBase.cs【验证是否登录】
namespace SSO.Public { public class AuthBase { public bool CheckLogin() { bool flg = true; HttpCookie cookie = HttpContext.Current.Request.Cookies[FormsAuthentication.FormsCookieName.ToString()]; //FormsAuthenticationTicket tk = (FormsAuthenticationTicket)(cookie.Value); if (cookie == null) flg= false; else { string name = FormsAuthentication.Decrypt(cookie.Value.ToString()).Name; if (name != "51aspx") flg= false; } return flg; } }
源代码下载:http://pan.baidu.com/netdisk/singlepublic?fid=1079743_1871944408