Sitefinity MVC External Authentication

Question

I am trying to get Sitefinity to work with MVC and JQuery Mobile and am having many issues....

The current issue is that I need to have users authenticate to access parts of the application. This authentication needs to be with an external service, the users logging into the front end will not be in the Sitefinity user base. I also need to have users who can log into the back-end to update the content, these users will be managed by Sitefinity.

To secure pages in MVC I add a authorize attribute on the controller. This needs to confirm the users on the front end have been authenticated by the external service, but still allow users logged into the back end to be able to updated content.

This is not working, when I hit the page with the authorize attribute on the front-end it is trying to take me to the sitefinity login. Has anyone found a way to make this work?

Answer 1

Well, I have a way to do it now, but I'm not all that excited with it...

I heard back from Sitefinity support and was given a few different ways to do this.

1) Create my own custom AuthorizeUser attribute, save the values when I authenticate to the session of a cookie, check for that value on the attribute...basically rewrite all the Authenticate functionality myself. - I'd really like to keep the Authenticate functionality as much as possible so I don't think I will do this.

2) Create a Custom Membership Provider, add this to the Sitefinity backend as a valid membership provider. This would be a good solution if I was wanting to store my users in a database and validate/update them. But, I am only validating against a service.

3) Create a dummy user in the Sitefinity backend with no access and definitely no backend access or admin access. After authenticating to my service if all is good then log into this user from the code. After this the [Authenticate] attribute finds that this user is logged in so all is good. As I do not need to check roles or claims in my app, just that user is logged in, this may work. It seems pretty ugly to me but I am assured that as long as the user does not have backend access or admin access it will not count to co-current users and many many users can be logged in as the same user.

I will go forward with option 3 and see how it goes and if I can get it past the architecture team.

here is the link where I found option 3 with some more info...

http://www.sitefinity.com/developer-network/forums/sitefinity-sdk/custom-authentication

Answer 2

James! Not sure but I think your 3rd party service should use the Sitefintiy Single Sign On.

Maybe the following help topic on how to setup Sitefinity single sign on will be helpful:

http://www.sitefinity.com/documentation/documentationarticles/authentication-models-overview