Showing posts with label authentication. Show all posts
Showing posts with label authentication. Show all posts

Wednesday, March 28, 2012

Atlas with authentication timout error

Hello!

I have an atlas web application that is also set up with forms authentication. The MembershipProvider "userIsOnlineTimeWindow" is set to "20". When i log the user in and leave the application on an AJAX enabled page (with updatepanels etc..) and then return to the application 23 minutes later - and click a button that triggers an updatepanel - i get a javascript error! Is there any way of dealing with this? Ideally i would just like the user to be redirected to the login page.

Please give me loads of details! :)

Thanks, Callam

You could set up a timer on the page to keep the authentication ticket live...

+++ Rick --


Hi Rick!

Thanks for that suggestion, but is that really what everyone who uses ATLAS in this way has to do? Are there no existing mechanisms? If i were to implement a timer - how would i go about it?

:) - Callam


The only way I don't know. But there's no built in mechanism for UpdatePanel at the moment to trigger it from the client. Remember UpdatePanel isn't all of ATLAS - there are other ways to make callbacks that give you much more control, but you have to do a little more work and write client script.

What I'm suggesting lets you still use UpdatePanel but gives you the behavior you want through a hack with a few lines of JavaScript code. Something like this:

function StartCallbacks()
{
$("btnHiddenFireFirstRequest").click();
window.setTimeout("$('btnHiddenSecondRequest').click()",100);
}

Now you have two server buttons with that don't post back on the form with the names above. You then set each of the update panel triggers to the appropriate button's click event and off you go.

Actually you may not need two buttons - probably only one since the initiating event can be something that would trigger anyway.

+++ Rick --


hello.

well, currently its's your best option. your other option is to build the authorization module so that you get the correct response when performing a partial postback and the session ticked has expired.


Hi Callam,

I use this solution to the same problem. In the Page_Load I put the following to detect a lost session while doing a partial postback:

// redirect if session is lost when doing a asynchroneous update (atlas)

if (((Microsoft.Web.UI.ScriptManager)Master.FindControl("asm")).IsInPartialRenderingMode)

{

if (null == Session["userid"])

{

Response.Redirect("~/login.aspx");

}

}

It works for me.

/lasse


Hi!

I'm not able to test that just yet - but is there allways a session variable called "userid" for formsAuthentication?

Thanks for your response! - Callam


Callam, I would suggest that you handle the PageRequestManager endRequest on the client, inspect the error and then based on that you can actually redirect from the client if the error was related to cookie expiration. simple code to handle endRequest error. You need to be onBeta1.0 to be able to run this code

<script language="javascript" type="text/javascript">

function endRequestEventHandler(sender, arg) {

arg.set_errorHandled(true);

if (e.get_error().message == '...')

...

}

Sys.WebForms.PageRequestManager.getInstance().add_endRequest(endRequestEventHandler);

</script>

Thanks,

Kashif


hello.

hum..is this really necessary? i mean, i'm convinced that the team has solved this issue with this release, ie, it properly detects the expiration of the cookie and automatically redirects the user to the login page.


Yes, the redirection handling happens automatically in Beta - the code relates more to if the user was getting an error during an async post-back and wanted to handle it on the client.

hello again.

hum...ok. i thought that the initial question was on how to prevent the error that used to happen in previous ctp when a timeout occurred.


where can i find the beta version that you guys are talking about? about 3 weeks ago i downloaded the latest version and used it when writing an authentication application. After leaving the authentication to time out, the first click of a postback ling resulted in nothing - and the second click redirected it to the login page

Can someone explain that?

:) thanks - this is brilliant help ;)

- Callam


hello.

well, i think it was released today (or yeasterday). it has lots of improvements and this bug has been solved on this latest release.


I linked to the Beta in the earlier post - but here goesagain

Ah great thanks a lot for that.

If i already have an application running on the july CTP, is it easy to upgrade it to the beta version? Thanks, Callam

Monday, March 26, 2012

Atlas UpdatePanel and FormsAuthentication Cookie Expiry

Hello all,

i have an ASP.NET 2 website that uses Forms Authentication. When the auth cookie expires, and an attempt is made to refresh a page or post-back, the browser is automatically redirected to the login page, according to settings in the web.config. All is well so far.

I then decided to use Atlas in my pages, specifically the "UpdatePanel" control in order to prevent the whole page being re-served each time when only one control needed to be updated. This also seemed to work fine.

The problem occurs when the Authentication Cookie has expired. Now instead of redirecting to the login page on a post-back, I just get a pop-up msgbox from IE6 saying simpy "Unknown Error". If I refresh the page however using the refresh browser button, i *do* get back to the login page.

I guess the Atlas Update Panel control is somehow minimising the HTML updates in the http reponse (which i guess is the whole point of the Update Panel control).. and blocking the redirect.

I have no clue how to get round this without removing Atlas - but that can't be the solution.. can it? :)

ok i've found my answer in the Atlas forums.. this is a bug in Atlas and although it was apparently supposed to be fixed in the 'next' CTP (July), it wasn't. So i'm not sure when it will be available.
I've not tried, but perhaps in your page load, something like
If Not Me.User.Identity.IsAuthenticatedThen FormsAuthentication.RedirectToLoginPage()End If

yeah, this work-around works.. almost.. if you put this in the Page_Load, it means that the actions of the postback are carried out on the server even though the user is no longer authenticated. Then, when the page_load is executed the user is redirected to the login page because it's only at this point that the authentication is checked.

It would be a bit better if the authentication could be checked in a single place in the Master page_load, but i'm not sure how to check the authentication from here since me.user.identity doesn't work.

Wednesday, March 21, 2012

Atlas Session Timeout/Expires

I have a secured area of my website that uses Forms authentication that I am trying to integrate Atlas into. The problem that I am having is that whenever my session expires and I try to do something that is within an UpdatePanel, it won't bounce me back to the login page. The remote request executes and the XMLHttp response back to my browser is the login page, but the client side components of Atlas don't know what to do with it?

Any ideas?

Jonathan

Hello Jonathan,

We will take a look and I will post a follow-up. Thanks for the info.


Same problem... Would really like a solutions...

Thanks for the feedback. We are working on a solution for a future release.


I have a solution, though not pretty...

Add a Meta Refresh for one second longer than your session timeout. This way the global refresh will redirect to the login page if the session times out. The Atlas postbacks will keep the session alive, so if the session is valid, the user will see a page refresh. Make sure you save state in session vars so you can return to the same point they were at.

-Jesse
Any update on this? We're also running into the same problem.

Thanks!

Jonas


The partial page rendering work from the last CTP release has undergone some revisiting and now handles this better. It will be available in our next release. The exact date for that is not yet nailed down, probably late September or early October.
What about for Webservice calls? Will there be a way to detect a session timeout/forms auth timeout there?

Jonas


Could anyone tell how it is finally done in the Release version?