Getting Forms Authentication from an ASP.NET logon page used by Silverlight 4 application

Question

This is supposed to just work. I've read all the articles I could find via google on the topic, tried to copy as much as I could from other articles on both StackOverflow and CodeProject and others, but regardless of what I try - it doesn't work.

I have a silverlight application that runs fine using Windows Authentication.

To get it running under Forms Authentication I've:

Edited the web.config file to enable Forms Authentication (and delete the Windows Authentication configuration):

    <authentication mode="Forms">
    <forms name=".ASPXAUTH" loginUrl="logon.aspx" defaultUrl="index.aspx"      protection="All" path="/" timeout="30" />
    </authentication>

Created a standard logon.aspx and logon.aspx.cs code behind page to take a user input name and password, and create a authentication cookie when the logon was successful, and then redirected the user to the root page of the web site, which is a silverlight application:

    private void cmdLogin_ServerClick( object sender, System.EventArgs e )
    {
        if ( ValidateUser( txtUserName.Value, txtUserPass.Value ) )
        {
            FormsAuthentication.SetAuthCookie(txtUserName.Value, true);
            var cookie = FormsAuthentication.GetAuthCookie(txtUserName.Value, true);
            cookie.Domain = "mymachine.mydomain.com";
            this.Response.AppendCookie(cookie);

            string strRedirect;
            strRedirect = Request["ReturnUrl"];
            if ( strRedirect == null )
                strRedirect = "index.aspx";
            Response.Redirect( strRedirect, true );
        }
    }

So the redirect after successfully logging in launches my silverlight application.

However the user is not authenticated when executing the Silverlight startup code:

    public App()
    {
        InitializeComponent();
        var webContext = new WebContext();
        webContext.Authentication = new FormsAuthentication();
        ApplicationLifetimeObjects.Add( webContext );
    }

    private void ApplicationStartup( object sender, StartupEventArgs e )
    {
        Resources.Add( "WebContext", WebContext.Current );

        // This will automatically authenticate a user when using windows authentication
        // or when the user chose "Keep me signed in" on a previous login attempt
        WebContext.Current.Authentication.LoadUser(ApplicationUserLoaded, null);

        // Show some UI to the user while LoadUser is in progress
        InitializeRootVisual();
    }

The error occurs in the ApplicationUserLoaded method, which always has its HasError property set to true on entry to the method.

    private void ApplicationUserLoaded( LoadUserOperation operation )
    {
        if((operation != null) && operation.HasError)
        {
            operation.MarkErrorAsHandled();
            HandlerShowWebServiceCallBackError(operation.Error, "Error loading user context.");
            return;
        }
        ...
    }

The error reported is as follows - from what it appears to me is that the user isn't considered authenticated on entry to the silverlight app, so it is directing the code to try to return the logon page, which is returning data unexpected by the silverlight app:

An exception occurred while attempting to contact the web service.
Please try again, and if the error persists, contact your administrator.

Error details:
Error loading user context.

Exception details:
Load operation failed for query 'GetUser'. The remote server returned an error: NotFound.

Any ideas?

Based on everything I read, this is supposed to be pretty simple and just work - so I'm obviously making a very basic error.

I'm wondering if after I authenticate the user on my logon.aspx web page, I need to somehow pass an authenticated WebContext instance over from the logon page to my silverlight application instead of creating a new instance in the silverlight app startup code - but have no idea how to do that.

Appreciate any or all suggestions.

Answer 1

I suspect the Response.Redirect("...", true);

According to this article you should pass false to keep the session.