I wanted to point out an issue with the AD Provider in hopes that it can be fixed in a future release.
We are running DNN 4.9.0 w/ AD Provider 01.00.04. We use mixed mode authentication with Integrated Windows Authentication for intranet users based on the Auto-login IP setting. Some intranet users occasionally need to use DNN accounts instead of their AD accounts, so they log out and manually log in with a DNN account. We found that the AD Provider was automatically reauthenticating these users with their AD account after exactly one hour. This occurred whether or not they were inactive and whether or not “Remember Login” was checked.
The culprit is the authentication.status.
cookie timeout set inside the AD Provider. When the cookie expires the provider forces AD authentication to occur by redirecting the user to WindowsSignin.aspx because it considers the authentication status to be undefined. My current workaround is to recreate the cookie and set no expiration so that it lasts for the entire session. If the user checks “Remember Login” I set the expiration to PersistentCookieTimeout from web.config. This seems to make DNN account logins work like they should for internal users instead of kicking them out after an hour.
To do this I added the following code to /admin/Authentication/Login.ascx.vb right after UserController.UserLogin is called to complete the login.
---------------Begin Code----------------
Dim authCookies As String = "authentication.status." & PortalId.ToString
If Not Request.Cookies(authCookies) Is Nothing Then
Dim Status As String = System.Web.Security.formsAuthentication.Decrypt(Request.Cookies(authCookies).Value).UserData
Dim Expiration As DateTime = DateTime.Now.AddMinutes(60)
If chkCookie.Checked Then
If Not DotNetNuke.Common.Utilities.Config.GetSetting("PersistentCookieTimeout") Is Nothing Then
Dim PersistentCookieTimeout As Integer = Integer.Parse(DotNetNuke.Common.Utilities.Config.GetSetting("PersistentCookieTimeout"))
If PersistentCookieTimeout <> 0 Then
Expiration = DateTime.Now.AddMinutes(PersistentCookieTimeout)
End If
End If
End If
' expire
Request.Cookies(authCookies).Value = Nothing
Request.Cookies(authCookies).Path = "/"
Request.Cookies(authCookies).Expires = DateTime.Now.AddYears(-1)
Dim AuthenticationTicket As New System.Web.Security.formsAuthenticationTicket(1, authCookies, DateTime.Now, Expiration, chkCookie.Checked, Status)
Response.Cookies(authCookies).Value = System.Web.Security.formsAuthentication.Encrypt(AuthenticationTicket)
Response.Cookies(authCookies).Path = "/"
If chkCookie.Checked Then
Response.Cookies(authCookies).Expires = Expiration
End If
End If
--------------- End Code -----------------