Re: Single Sign On

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

As many times as I have seen this question asked I can't believe that no one
is talking about it.

I wanted to update the group on what I did do to get SSO to work in a forms
based app in a way that I thought was secure.

1. create a Web part page in a site

2. modify that pages body element to run a script <body onLoad="sendform()">

3. create and install a web part the page that writes out this script
(assuming you know the elements of the form of the page you are trying to
SSO into:

StringBuilder myString = new StringBuilder();

myString.Append("<script language=\"JavaScript\">\r");

myString.Append("function sendform(){\r");

myString.Append("mywindow=window.open(\"YOUR URL\");\r");

myString.Append("while(mywindow.document.readyState != 'complete'){}\r");

myString.Append("mywindow.document.getElementById('username').value='" +
rgGetCredentialsData[0] + "';\r");

myString.Append("mywindow.document.getElementById('password').value='" +
rgGetCredentialsData[1] + "';\r");

myString.Append("mywindow.document.getElementById('ssoform').submit()}\r");

myString.Append("</script>\r");

if(!Page.IsClientScriptBlockRegistered("sendform"))

Page.RegisterClientScriptBlock("sendform", myString.ToString());

4. Create a page in an excluded path that has a mock-up of the form in your
real page that you want to SSO into. This form should submit to the real
page

This solves the problem of trying to write directly to the real page--you
will get an access denied when you try to write into a form element that
tries to cross domains.

It also solves the problem of knowing when the page is loaded so you can
start writing into the pages form elements without geting an error.

It may not work with Netscape. If it does not then you can open a blank
browser and write all of the form elements from your webparts script and
then submit it. I just tried my way first and Netscape is not an issue for
me.

Another site that I have uses a ton of javascript so I basically had to make
a complete copy of the page instead of only the form elements

I know this is spoofing but it works.

I hope this makes sense. Let me know if it works for you.


.