Hoppa till huvudinnehållet

External Security Providers compared to Geocortex Security Provider

Permanently deleted user

I have a question regarding the various security provider options... 

Sites that are password protected with the Geocortex Security Provider prompt for re-entry of login credentials every time the browser is refreshed. 

If the site is password protection using Windows authentication, the browser window can be refreshed without requiring a re-entry of login credentials. 

My question:  If the security provider is changed to an external provider, such as SQL Server Provider, will the site prompt for re-entry of login credentials if the browser is refreshed?

Thanks,

Steve

 

 

 

0

Kommentarer

4 kommentarer

Datum Röster
  • Permanently deleted user

    Hi Steve,

    I just tested now and I don't get asked for a password on refresh when using Geocortex Security Provider. My understanding is that you shouldn't be asked to log in again until after your token expires even if you close the web browser. I can also get a token from the http://{servername}/Geocortex/Essentials/REST/sites/{sitename}/authenticate page then open the site directly and it won't ask for a password.

    Maybe it's a configuration issue where you have to explicitly say you want to use tokens? Checking the doco might give some more information.

    0
  • Permanently deleted user

    Thanks for checking.

    I've been through the documentation several times.  There's nothing to indicate a configuration issue that requires the explicit use of tokens. 

    Has anyone else tried this?

     

     

     

     

     

    0
  • Permanently deleted user

    Hi Steve,

    Essentials will always use the token service when authenticating users with an external provider.  It doesn't use the token service when you secure your site with Windows security, because the security is implemented by IIS on the HTTP protocol level, so if you can get a site then you're already authenticated and there's nothing more to do.

    When you log in to the HTML REST endpoint (the .../authenticate page that Mike mentioned), you also get a browser cookie with the token that is displayed.  When your browser submits this cookie to an Essentials endpoint, that token gets used if there isn't one in the URL parameters, so you can skip the login prompt if you somehow have got this value and have set it in the browser.

    The Silverlight plugin won't set the token as a cookie so it will always display a login prompt on a token-secured site.

    Regards,

    -Malcolm

    0
  • Permanently deleted user

    Thanks Malcolm, that was a great explanation! 

    (Especially considering I neglected to mention this site is using the Silverlight Viewer.)

    Steve

     

     

    0

Du måste logga in om du vill lämna en kommentar.

Hittade du inte vad du sökte?

Nytt inlägg